CVE-2026-36959 Details

A vulnerability in the U-SPEED N300 router, specifically in firmware version 1.0.0, allows for unlimited authentication attempts on the '/api/login' endpoint. This lack of rate limiting or account lockout protections enables attackers on the local network to conduct brute-force attacks against the administrator account, potentially leading to unauthorized access to the router's management interface.

To address this vulnerability, implement rate limiting on the '/api/login' endpoint and add account lockout features after a certain number of failed login attempts. Consider introducing exponential backoff strategies or CAPTCHA challenges to further mitigate the risk.