CVE-2026-36960

HighCVSS 8.8

Published: 30/04/2026(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

7th percentile - higher than 7% of all known CVEs

Summary

The web management interface of the U-SPEED N300 Router V1.0.0 lacks CSRF protection mechanisms like anti-CSRF tokens or strict Origin/Referer validation. An attacker can craft a malicious webpage that sends forged HTTP requests to configuration endpoints. If an authenticated administrator visits the page, the browser includes the valid session cookie, allowing unauthorized administrative actions.

Risk Assessment

The risk involves an attacker remotely making unauthorized configuration changes to the router without the administrator's knowledge. This could lead to network integrity compromise, device takeover, or further attacks on the infrastructure.

Recommendation

Immediately update the router firmware to the latest version that includes CSRF protection. Until then, restrict management interface access to trusted networks and implement additional safeguards like Origin header validation.

Other vulnerabilities in U-SPEED N300 Router

CVE-2026-36959High
The U-SPEED N300 router version V1.0.0 does not implement rate limiting or account lockout protections on the /api/login endpoint. This allows an attacker on the local network to perform unlimited authentication attempts, enabling brute-force attacks against the administrator account and potential unauthorized access to the router management interface.

Original NVD description (English source)

A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the U-SPEED N300 Rounter V1.0.0. The device does not implement CSRF protection mechanisms such as anti-CSRF tokens or strict Origin/Referer validation for administrative API endpoints. An attacker can craft a malicious webpage that sends forged HTTP requests to configuration endpoints. If an authenticated administrator visits the malicious webpage, the victim's browser automatically includes the valid session cookie in the request, allowing the router to process the request as a legitimate administrative action.