PT-2026-36102 · Dbit · N300 T1 Pro

Kirubel-Cve · Published 2026-04-30 · Updated 2026-05-05 · CVE-2026-36956

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dbit N300 T1 Pro wireless router version 1.0.0

Description A Cross-Site Request Forgery (CSRF) issue exists in the web management interface. The device fails to implement proper protection mechanisms, such as anti-CSRF tokens or strict Origin/Referer validation, for administrative API endpoints. An attacker can craft a malicious webpage to send forged HTTP requests to configuration endpoints, such as "/api/setWlan". If an authenticated administrator visits this page, the browser automatically includes the session cookie, allowing the request to be processed as a legitimate administrative action.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-36956

Affected Products

N300 T1 Pro

References · 5

• 🔥 https://github.com/kirubel-cve/CVE-2026-36956 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-36956 · Security Note
• https://t.me/CVEtracker/52321 · Telegram Post
• https://t.me/cveNotify/162103 · Telegram Post
• http://dbit.com · Note