CVE-2026-36956 Details
Description
A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the Dbit N300 T1 Pro wireless router V1.0.0. The router fails to implement proper CSRF protection mechanisms such as anti-CSRF tokens or strict Origin/Referer validation for administrative API endpoints. An attacker can craft a malicious webpage that sends forged HTTP requests to configuration endpoints such as /api/setWlan. If an authenticated administrator visits the malicious webpage, the victim's browser automatically includes the valid session cookie in the request, allowing the router to process the request as a legitimate administrative action.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the Dbit N300 T1 Pro wireless router, specifically in firmware version 1.0.0. The router lacks adequate CSRF protection, such as anti-CSRF tokens or strict validation of Origin/Referer headers for administrative API endpoints. This vulnerability allows an attacker to create a malicious webpage that sends forged HTTP requests to configuration endpoints. If an authenticated administrator visits the page, the router processes the request as a legitimate action, potentially leading to unauthorized changes in the router's settings.
To address this vulnerability, implement anti-CSRF tokens on all state-changing endpoints, enforce strict validation of Origin and Referer headers, and use the SameSite=Strict attribute for session cookies.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/kirubel-cve/CVE-2026-36956 | CISA-ADP | ExploitThird Party Advisory |
| https://github.com/kirubel-cve/CVE-2026-36956 | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| dbitnet dbit n300 t1 pro firmware | 1.0.0 |
CPE
Remediation
| |
| dbitnet dbit n300 t1 pro | All versions |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 5, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 5, 2026 | Initial Analysis | [email protected] |
| Apr 30, 2026 | CVE Modified | CISA-ADP |
| Apr 30, 2026 | New CVE Received | [email protected] |