T Cpe301K 4G Mini Wifi Router
Monthly
A stack-based buffer overflow in the web management interface of the Shenzhen Dbit T-CPE301K 4G mini WiFi router allows an attacker who already holds a session on the device to crash the router and force a reboot by sending an HTTP POST to /js/common/do_cmd.js with an excessively long parameter. The published CVSS 4.0 score of 9.3 treats this as remote, unauthenticated, and full impact to confidentiality, integrity, and availability, but our independent assessment scores it under CVSS 3.1 as AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, i.e. an authenticated, availability-only denial-of-service, because exploitation requires network reachability to the management interface plus a valid session on the endpoint, and the confirmed outcome is a crash and restart rather than code execution. There is no CISA KEV listing and no public exploit code identified at time of analysis, and the practical risk is further limited by the small deployment footprint of this consumer/SOHO-class router; a vendor patch is available per the INCIBE advisory.
Static, predefined Telnet credentials in the Shenzhen Dbit T-CPE301K 4G WiFi mini-router allow any attacker already present on the same local network to log into the device's Telnet service on port 23 and obtain full root access. Because the credentials are fixed in firmware and shared across units, no brute-forcing or account setup is required - mere knowledge of the default password is enough to achieve complete confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) on the router, which sits at a trust boundary for everything behind it. Exposure is constrained to adjacent-network attackers rather than the open internet, so realistic risk comes from other WiFi clients, guest users, or an attacker who has gained a foothold on the local segment; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV. A vendor patch is available per the INCIBE advisory.
A stack-based buffer overflow in the web management interface of the Shenzhen Dbit T-CPE301K 4G mini WiFi router allows an attacker who already holds a session on the device to crash the router and force a reboot by sending an HTTP POST to /js/common/do_cmd.js with an excessively long parameter. The published CVSS 4.0 score of 9.3 treats this as remote, unauthenticated, and full impact to confidentiality, integrity, and availability, but our independent assessment scores it under CVSS 3.1 as AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, i.e. an authenticated, availability-only denial-of-service, because exploitation requires network reachability to the management interface plus a valid session on the endpoint, and the confirmed outcome is a crash and restart rather than code execution. There is no CISA KEV listing and no public exploit code identified at time of analysis, and the practical risk is further limited by the small deployment footprint of this consumer/SOHO-class router; a vendor patch is available per the INCIBE advisory.
Static, predefined Telnet credentials in the Shenzhen Dbit T-CPE301K 4G WiFi mini-router allow any attacker already present on the same local network to log into the device's Telnet service on port 23 and obtain full root access. Because the credentials are fixed in firmware and shared across units, no brute-forcing or account setup is required - mere knowledge of the default password is enough to achieve complete confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) on the router, which sits at a trust boundary for everything behind it. Exposure is constrained to adjacent-network attackers rather than the open internet, so realistic risk comes from other WiFi clients, guest users, or an attacker who has gained a foothold on the local segment; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV. A vendor patch is available per the INCIBE advisory.