Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
U-SPEED N300 router V1.0.0 does not implement rate limiting or account lockout protections on the /api/login endpoint. This allows an attacker on the local network to perform unlimited authentication attempts, enabling brute-force attacks against the administrator account and potential unauthorized access to the router management interface.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 2 products
| Date | Total | Labels |
|---|
| 2026-04-30 | 1 | General1 |
| 2026-06-25 | 1 | Disclosure1 |
🔴 U-SPEED Router, Missing Rate Limiting on Authentication Endpoint, #CVE-2026-36959 (High) -DC-Jun2026-638 https://dailycve.com/u-speed-router-missing-rate-limiting-on-authentication-endpoint-cve-2026-36959-high-dc-jun2026-638/
Post summary
The post announces CVE-2026-36959, noting a lack of rate limiting on authentication endpoints in U‑SPEED routers, with no further exploitation or remediation details.
CVE-2026-36959 CVE-2026-36959 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-36959
Post summary
The provided text lists CVE-2026-36959 twice and includes a link to a VulMon details page, but offers no additional information on the vulnerability or related activities.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| HW | u-speed | n300 | - | - | - |
| OS | u-speed | n300_firmware | 1.0.0 | - | - |