CVE-2026-36956
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the Dbit N300 T1 Pro wireless router V1.0.0 due to missing anti-CSRF tokens and Origin/Referer validation. An attacker can trick an authenticated administrator into visiting a malicious page that sends forged requests to configuration endpoints like /api/setWlan.
Risk Assessment
The risk is that an attacker can modify router configuration (e.g., wireless settings) without the administrator's consent, potentially leading to network compromise or device takeover.
Recommendation
Update the router firmware to the latest version that includes CSRF fixes immediately. Until then, restrict management interface access to trusted networks and consider additional authentication measures.
Other vulnerabilities in Dbit N300 T1 Pro
Original NVD description (English source)
A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the Dbit N300 T1 Pro wireless router V1.0.0. The router fails to implement proper CSRF protection mechanisms such as anti-CSRF tokens or strict Origin/Referer validation for administrative API endpoints. An attacker can craft a malicious webpage that sends forged HTTP requests to configuration endpoints such as /api/setWlan. If an authenticated administrator visits the malicious webpage, the victim's browser automatically includes the valid session cookie in the request, allowing the router to process the request as a legitimate administrative action.