17 matches found
CVE-2026-36960
CVE-2026-36960: تزوير الطلبات عبر المواقع CSRF في واجهة الإدارة عبر الويب معرف CVE: CVE-2026-36960 التاريخ: 2026-04-29 مكتشف الثغرة: Kirubel Solomne البائع: U-SPEED المنتج: راوتر U-SPEED إصدار البرنامج الثابت: V1.0.0 CWE: CWE-352 - تزوير الطلبات عبر المواقع CSRF الوصف لا يطبّق البرنامج الثابت...
CVE-2026-36959
CVE-2026-36959: غياب تحديد معدل الطلبات على نقطة نهاية تسجيل الدخول معرف CVE: CVE-2026-36959 التاريخ: 2026-04-29 المكتشف: Kirubel Solomne البائع: U-SPEED المنتج: راوتر U-SPEED إصدار البرنامج الثابت: V1.0.0 CWE: CWE-307 - تقييد غير صحيح لمحاولات المصادقة المفرطة الوصف لا يطبّق البرنامج الثابت V1.0...
CVE-2026-36958
CVE-2026-36958: رفض الخدمة عبر طلبات HTTP المتزامنة معرف CVE: CVE-2026-36958 التاريخ: 2026-04-29 المكتشف: Kirubel Solomne البائع: U-SPEED المنتج: راوتر U-SPEED إصدار البرنامج الثابت: V1.0.0 CWE: CWE-400 - استهلاك غير متحكم فيه للموارد الوصف البرنامج الثابت V1.0.0 لراوتر U-SPEED عرضة لرفض الخدمة. ...
CVE-2026-36960
A Cross-Site Request Forgery CSRF vulnerability exists in the web management interface of the U-SPEED N300 Rounter V1.0.0. The device does not implement CSRF protection mechanisms such as anti-CSRF tokens or strict Origin/Referer validation for administrative API endpoints. An attacker can craft ...
CVE-2026-36959
U-SPEED N300 router V1.0.0 does not implement rate limiting or account lockout protections on the /api/login endpoint. This allows an attacker on the local network to perform unlimited authentication attempts, enabling brute-force attacks against the administrator account and potential unauthoriz...
EUVD-2026-30044
U-SPEED AC1200 Gigabit Wi-Fi Router Model: T18-21K V1.0 is vulnerable to Command Injection. The Network Time Protocol NTP configuration interface does not properly sanitize user-supplied input. An authenticated user with permission to configure NTP settings can inject arbitrary system commands...
CVE-2026-36741
U-SPEED AC1200 Gigabit Wi-Fi Router Model: T18-21K V1.0 is vulnerable to Command Injection. The Network Time Protocol NTP configuration interface does not properly sanitize user-supplied input. An authenticated user with permission to configure NTP settings can inject arbitrary system commands...
CVE-2026-36738
U-SPEED AC1200 Gigabit Wi-Fi Router Model: T18-21K V1.0 is vulnerable to Incorrect Access Control. The device exposes a UART interface that lacks authentication, authorization, or access control mechanisms. An attacker with physical access to the UART pins can connect to the interface and gain...
CVE-2026-36738
U-SPEED AC1200 Gigabit Wi-Fi Router Model: T18-21K V1.0 is vulnerable to Incorrect Access Control. The device exposes a UART interface that lacks authentication, authorization, or access control mechanisms. An attacker with physical access to the UART pins can connect to the interface and gain...
CVE-2026-36958
A denial-of-service vulnerability exists in the U-SPEED N300 V1.0.0 wireless router. By sending a large number of concurrent HTTP requests to random or non-existent endpoints on the web management interface, an attacker can exhaust system resources in the embedded Boa HTTP server. This causes the...
CVE-2026-36960
A Cross-Site Request Forgery CSRF vulnerability exists in the web management interface of the U-SPEED N300 Rounter V1.0.0. The device does not implement CSRF protection mechanisms such as anti-CSRF tokens or strict Origin/Referer validation for administrative API endpoints. An attacker can craft ...
CVE-2026-36960
A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the U-SPEED N300 Rounter V1.0.0 . The root cause is a lack of protection mechanisms, such as anti-CSRF tokens or strict Origin/Referer validation , for administrative API endpoints. An attacker can trick a...
EUVD-2026-26386
A Cross-Site Request Forgery CSRF vulnerability exists in the web management interface of the U-SPEED N300 Rounter V1.0.0. The device does not implement CSRF protection mechanisms such as anti-CSRF tokens or strict Origin/Referer validation for administrative API endpoints. An attacker can craft ...
CVE-2026-36960
A Cross-Site Request Forgery CSRF vulnerability exists in the web management interface of the U-SPEED N300 Rounter V1.0.0. The device does not implement CSRF protection mechanisms such as anti-CSRF tokens or strict Origin/Referer validation for administrative API endpoints. An attacker can craft ...
U-SPEED N300 资源管理错误漏洞
The U-SPEED N300 is a wireless router device produced by the U-SPEED company. The U-SPEED N300 V1.0.0 version has a resource management vulnerability. This vulnerability stems from a denial-of-service attack on the embedded Boa HTTP server. It is possible for attackers to exhaust system resources...
CVE-2026-36959
U-SPEED N300 router V1.0.0 does not implement rate limiting or account lockout protections on the /api/login endpoint. This allows an attacker on the local network to perform unlimited authentication attempts, enabling brute-force attacks against the administrator account and potential unauthoriz...
