LiveActive security incident?Get immediate response
CVE Record

CVE-2026-36959: U-SPEED N300 router V1.0.0 does not implement rate limiting or account lockout protections on the /api/logi...

U-SPEED N300 router V1.0.0 does not implement rate limiting or account lockout protections on the /api/login endpoint. This allows an attacker on the local network to perform unlimited authentication attempts, enabling brute-force attacks against the administrator account and potential unauthorized access to the router management interface.

HighCVSS 7.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2026-36959 affects U-SPEED N300 router firmware V1.0.0. The router’s login API lacks rate limiting or account lockout, allowing repeated administrator password guesses from the local network. Successful guessing could give an attacker access to the router management interface.

Executive priority

Prioritize if these routers are deployed in offices, shared networks, or environments with many unmanaged devices. The main business risk is unauthorized router administration, which can expose traffic, change network settings, or weaken perimeter controls.

Technical view

The issue is CWE-307: improper restriction of excessive authentication attempts on /api/login. CVSS 3.1 is 7.5 High, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The published description limits the attack scenario to local network access and administrator account brute forcing.

Likely exposure

Organizations using U-SPEED N300 routers running V1.0.0 are the stated exposure. Risk is highest where untrusted users or compromised devices share the local network with router management access.

Exploitation context

The source bundle does not show CISA KEV listing or confirmed active exploitation. A public GitHub reference is listed. The vulnerability requires network reachability to the router login endpoint and relies on weak or guessable administrator credentials.

Researcher notes

Evidence is limited to the CVE record metadata and the referenced GitHub page. The affected-product fields in the bundle are marked n/a, while the title and description name U-SPEED N300 V1.0.0. No official vendor advisory or patch is provided in the bundle.

Mitigation direction

  • Check vendor guidance for patched firmware or official mitigations.
  • Use a strong, unique administrator password.
  • Restrict router management access to trusted local devices only.
  • Separate guest or untrusted devices from the management network.
  • Monitor router login failures and administrative changes.

Validation and detection

  • Inventory U-SPEED N300 routers and confirm firmware version.
  • Determine whether /api/login is reachable from local network segments.
  • Review configuration for management access restrictions.
  • Review logs for repeated failed administrator login attempts.
  • Confirm whether vendor firmware or guidance is available.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-307: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-36959 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
2Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: pocAutomatable: yesTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N3.93.6CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2026-36959Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

CWE-307

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.