CVE-2026-36960 - Vulnerability Analysis

Overview

U-SPEED N300 Router V1.0.0 contains a cross site request forgery caused by lack of anti-CSRF tokens and strict Origin/Referer validation in administrative API endpoints, letting attackers force authenticated administrators to perform unintended actions.

Severity & Score

Impact

Attackers can trick authenticated administrators into executing unauthorized administrative actions, potentially compromising router configuration.

Mitigation

Implement anti-CSRF tokens and strict Origin/Referer validation on administrative API endpoints.

References

• http://u-speed.com
• https://github.com/kirubel-cve/CVE-2026-36960

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner