CVE-2025-71383: Dbit WIFI4 N300 vulnerability

Published Oct 6, 2026

Updated

Dbit WIFI4 N300 1.0.0 devices allow the management interface to be crashed via a request (from the local Wi-Fi network) that lacks a /api/login username or password field. This occurs because of an error in a JSON parser.

Affected Software

1 affected component

Dbit WIFI4 N300=1.0.0

Event History

Oct 6, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·05:17 PM

Description

Frequently Asked Questions

Who can trigger the management-interface crash?

An attacker must be on the device's local Wi-Fi network. The issue is reachable through a request to the management interface.

What malformed request causes the crash?

A request to /api/login that omits the username or password field can crash the management interface. The failure is caused by an error in the JSON parser.

Does exploitation require valid management credentials?

The available information does not state that credentials are required. It describes a request missing username or password fields, but does not explicitly document the authentication requirements for reaching the endpoint.

CVE-2025-71383: Dbit WIFI4 N300 vulnerability

Affected Software

Event History

Frequently Asked Questions

Who can trigger the management-interface crash?

What malformed request causes the crash?

Does exploitation require valid management credentials?

Company

Resources

Contact

Frequently Asked Questions

Who can trigger the management-interface crash?

What malformed request causes the crash?

Does exploitation require valid management credentials?