CVE-2026-36959
HIGH 1 PoC
MEDIUM
Priority: 0.03
BB Relevance:
85/100
Published: 2026-04-30
Modified: 2026-11-08
First seen: 2026-11-08
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
Conf. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
S:
Unchanged
C:
High
I:
None
A:
None
Description
U-SPEED N300 router V1.0.0 does not implement rate limiting or account lockout protections on the /api/login endpoint. This allows an attacker on the local network to perform unlimited authentication attempts, enabling brute-force attacks against the administrator account and potential unauthorized access to the router management interface.
Weakness Classification (1)
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| u-speed | n300_firmware | 1.0.0 |
References & Advisories (1)
Exploit
Third Party Advisory