CVE-2026-36957 Denial of service in n/a
An attacker can cause a system hang and disable routing by flooding the router's web server with requests to non-existent URIs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-36957?
CVE-2026-36957 is a high-severity denial of service vulnerability in n/a, published on 30 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router V1.0.0 is vulnerable to Denial of Service via the boa web server URI handler. By initiating a high-volume flood of HTTP GET requests to non-existent URIs, an attacker can exhaust critical system resources, including file descriptors and memory buffers. This results in a kernel deadlock or system hang that disables the web management portal and all routing capabilities.
Weakness: CWE-400
Which versions are affected by CVE-2026-36957?
It affects 1 product.
Products include Dbitnet Dbit N300 T1 Pro Firmware.
How do I fix CVE-2026-36957?
No fix has been published for CVE-2026-36957 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-36957 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-36957 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as GHSA-rgwg-779v-cfx3.