# CVE-2026-36960: U-SPEED N300 Router CSRF in web management interface

Source: https://junglewise.ai/threats/cve-2026-36960-u-speed-n300-router-csrf-in-web-management-interface  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-30. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2026-36960 · Severity: high · CVSS 8.8 · Published 2026-04-30

A security vulnerability exists in the U-SPEED N300 router, a device used to provide wireless internet connectivity. An attacker can trick a logged-in administrator into visiting a malicious website, which then silently sends commands to the router. This could allow an attacker to change the Wi-Fi password, take over the network, or disable the device entirely.

Vendors: [U-SPEED](https://junglewise.ai/threats/vendors/u-speed).

## Quick answers

**Is CVE-2026-36960 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-36960 being exploited in the wild.

**How severe is CVE-2026-36960?** High severity, with a CVSS score of 8.8, published 30 April 2026.

**Which products and versions are affected?** U-SPEED N300 Router V1.0.0.

**Is there a fix for CVE-2026-36960?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-36960 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-36960?** Check whether you run U-SPEED N300 Router at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The U-SPEED N300 Router V1.0.0 firmware is vulnerable to Cross-Site Request Forgery (CSRF) because its web management interface lacks protection mechanisms such as anti-CSRF tokens or strict Origin/Referer validation. The vulnerability affects administrative API endpoints including /api/setWlan and /api/telnet. An unauthenticated remote attacker can exploit this by crafting a malicious webpage that sends forged POST requests to these endpoints. If an authenticated administrator interacts with the malicious page, their browser will automatically include session cookies, leading to unauthorized configuration changes, such as modifying Wi-Fi settings or enabling Telnet. As of the disclosure, no official patch has been confirmed, though remediation involves implementing anti-CSRF tokens and SameSite cookie attributes.

## Affected products

- U-SPEED N300 Router V1.0.0

## Timeline

- 2026-04-29: disclosed: Vulnerability discovered and public disclosure occurred.
- 2026-04-30: advisory: NVD published the CVE record.

## References

- [https://github.com/kirubel-cve/CVE-2026-36960](https://github.com/kirubel-cve/CVE-2026-36960)

## Related threats

- [U-SPEED N300 missing rate limiting in /api/login](https://junglewise.ai/threats/cve-2026-36959-u-speed-n300-missing-rate-limiting-in-api-login)