# CVE-2026-36956: Dbit N300 T1 Pro CSRF in web management interface

Source: https://junglewise.ai/threats/cve-2026-36956-dbit-n300-t1-pro-csrf-in-web-management-interface  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-30. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2026-36956 · Severity: high · CVSS 8.8 · Published 2026-04-30

A security vulnerability exists in the Dbit N300 T1 Pro wireless router, which is used to provide internet connectivity and manage local network settings. An attacker can trick a logged-in administrator into visiting a malicious website that silently sends commands to the router. This could allow the attacker to change the Wi-Fi name and password, modify network settings, or take full control of the device's configuration.

Technologies: [Dbitnet Dbit N300 T1 Pro](https://junglewise.ai/threats/technologies/dbit-n300-t1-pro), [Dbitnet Dbit N300 T1 Pro Firmware](https://junglewise.ai/threats/technologies/dbit-n300-t1-pro-firmware). Vendors: [Dbit](https://junglewise.ai/threats/vendors/dbit), [Dbitnet](https://junglewise.ai/threats/vendors/dbitnet).

## Quick answers

**Is CVE-2026-36956 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-36956 being exploited in the wild.

**How severe is CVE-2026-36956?** High severity, with a CVSS score of 8.8, published 30 April 2026.

**Which products and versions are affected?** Dbit N300 T1 Pro Firmware 1.0.0.

**Is there a fix for CVE-2026-36956?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-36956 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-36956?** Check whether you run Dbit N300 T1 Pro Firmware, Dbitnet Dbit N300 T1 Pro or Dbitnet Dbit N300 T1 Pro Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the Dbit N300 T1 Pro wireless router running firmware V1.0.0. The device fails to implement anti-CSRF tokens or validate Origin/Referer headers for sensitive administrative API endpoints, such as /api/setWlan, /api/setWan, and /api/setSystem. An unauthenticated remote attacker can craft a malicious webpage that, when visited by an authenticated administrator, leverages the browser's automatic inclusion of session cookies to execute forged POST requests. Successful exploitation allows the attacker to modify wireless settings (SSID/password), WAN configurations, or achieve full device takeover. As of the disclosure date, no official patch has been confirmed by the vendor.

## Affected products

- Dbit N300 T1 Pro Firmware 1.0.0

## Timeline

- 2026-04-29: disclosed: Vulnerability discovered and reported to MITRE
- 2026-04-30: advisory: NVD published the CVE record

## References

- [https://github.com/kirubel-cve/CVE-2026-36956](https://github.com/kirubel-cve/CVE-2026-36956)

## Related threats

- [Dbit N300 T1 Pro denial of service in Boa web server](https://junglewise.ai/threats/cve-2026-36957-dbit-n300-t1-pro-denial-of-service-in-boa-web-server)
- [Dbit N300 T1 Pro missing rate limiting in login API](https://junglewise.ai/threats/cve-2025-65427-dbit-n300-t1-pro-missing-rate-limiting-in-login-api)