CVE-2026-36956: CSRF
A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the Dbit N300 T1 Pro wireless router V1.0.0. The router fails to implement proper CSRF protection mechanisms such as anti-CSRF tokens or strict Origin/Referer validation for administrative API endpoints. An attacker can craft a malicious webpage that sends forged HTTP requests to configuration endpoints such as /api/setWlan. If an authenticated administrator visits the malicious webpage, the victim's browser automatically includes the valid session cookie in the request, allowing the router to process the request as a legitimate administrative action.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dbit N300 T1 Pro wireless routerto a version that resolves this vulnerability.Fixed in V1.0.0 - Compensating control
Restrict access to the router web management interface and administrative API endpoints (e.g., endpoints such as /api/setWlan) so they are not reachable from untrusted networks/hosts.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-36956?
CVE-2026-36956 has been classified with a medium severity level, reflecting its potential impact on the web management interface of the Dbit N300 T1 Pro router.
How do I fix CVE-2026-36956?
To mitigate CVE-2026-36956, update the Dbit N300 T1 Pro router to the latest firmware version that addresses the CSRF vulnerability.
What types of attacks can exploit CVE-2026-36956?
CVE-2026-36956 can be exploited through Cross-Site Request Forgery (CSRF) attacks, allowing unauthorized commands to be executed on the router.
Who is affected by CVE-2026-36956?
CVE-2026-36956 affects users of the Dbit N300 T1 Pro router running version 1.0.0.
What are the consequences of CVE-2026-36956 if exploited?
If exploited, CVE-2026-36956 can lead to unauthorized access to the router’s configuration settings, potentially compromising the network's security.