Is this vulnerability remotely exploitable from the internet?

It can be indirectly exploitable if an attacker can entice an authenticated administrator to visit a malicious webpage while their browser can reach the router's management IP. Direct internet reachability of the admin interface is not strictly required if the victim's browser is on the same network, but exposing the interface to the internet significantly increases risk.

Does an attacker need valid router credentials to exploit this?

The attacker does not need credentials if the administrator is already authenticated. The attack leverages the victim's existing session and browser-stored cookies; the critical requirement is that the victim is logged in (or has a valid session) when visiting the malicious page.

What is the safest general fix pattern for this class of issue?

The safest pattern is to require per-request CSRF tokens for all state-changing administrative actions, validate them server-side, and combine this with strict Origin/Referer header enforcement. These measures ensure that only requests originating from the legitimate management interface are honored.

Severity:

HIGH RISK

(8.8)

Cross-Site Request Forgery (CWE-352) in U-SPEED N300 Router Web Management Interface

CVE-2026-36960

Published:

Apr 30, 2026

Status:

Deferred

Summary

Affected Context

Exploit Preconditions

Why This Happens

Potential Impact

General Mitigation Guidance

How Teams Detect Issues Like This

Frequently Asked Questions

Source

NDV

Recent Vulnerabilities

CWE-284;CWE-434

HIGH RISK

HIGH

(7.3)

Unrestricted File Upload (CWE-434) via Engine Handler exec in MindsDB BYOM Integration

Remote Code Execution and Arbitrary File Upload

May 3, 2026

CWE-287

HIGH RISK

HIGH

(7.3)

Improper Authentication (CWE-287) in JwtAuthenticationTokenFilter of yudao-cloud Ruoyi-Vue-Pro

Authentication Bypass / Unauthorized Access

May 3, 2026

Vulnerability Type

Category:

Cross-Site Request Forgery (CSRF)

CWE:

CWE-352

Impact:

Unauthorized Administrative Actions and Configuration Manipulation

Severity:

HIGH RISK

(8.8)

CVSS Version:

3.1

Vulnerability Type

Category:

Cross-Site Request Forgery (CSRF)

CWE:

CWE-352

Impact:

Unauthorized Administrative Actions and Configuration Manipulation

Severity:

HIGH RISK

(8.8)

CVSS Version:

3.1

Catch This CVE While Code Is Being Written

Detect vulnerable code directly in pull requests, so CVEs are fixed before merge.

Get Started

Ship clean & secure code faster

START 14 DAYS FREE TRIAL

BOOK A DEMO

Made with Love in San Francisco

355 Bryant St. San Francisco, CA 94107, USA

Ask AI for summary of CodeAnt

Made with Love in San Francisco

355 Bryant St. San Francisco, CA 94107, USA

Ask AI for summary of CodeAnt

Made with Love in San Francisco

355 Bryant St. San Francisco, CA 94107, USA

Ask AI for summary of CodeAnt

Cross-Site Request Forgery (CWE-352) in U-SPEED N300 Router Web Management Interface

Summary

Affected Context

Exploit Preconditions

Why This Happens

Potential Impact

General Mitigation Guidance

How Teams Detect Issues Like This

Frequently Asked Questions

Source

Recent Vulnerabilities

HIGH RISK

HIGH

(7.3)

Unrestricted File Upload (CWE-434) via Engine Handler exec in MindsDB BYOM Integration

HIGH RISK

HIGH

(7.3)

Improper Authentication (CWE-287) in JwtAuthenticationTokenFilter of yudao-cloud Ruoyi-Vue-Pro

Vulnerability Type

Vulnerability Type

Vulnerability Type

Catch This CVE While Code Is Being Written

Ship clean & secure code faster

Product

Pricing

Company

Legal

Developers

Compare

Product

Pricing

Company

Legal

Developers

Compare

Product

Pricing

Company

Legal

Developers

Compare