kirubel-cve/cve-2025-65427Proof-of-concept exploit for CVE-2025-65427: missing rate limiting on Dbit N300 T1 Pro router login API enabling brute-force attacks and administrative takeover.
CVE ID: CVE-2025-65427
Date: 2025-12-16
Discoverer: Kirubel
Product: Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router
Firmware Version: V1.0.0
An issue was discovered in the Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router on firmware version V1.0.0. The device does not implement rate limiting on the /api/login endpoint (CWE-307).
This allows remote attackers to execute brute-force or credential-stuffing attacks via automated HTTP POST requests. Successful exploitation results in administrative takeover, allowing configuration changes, DNS modification, or firmware updates.
The vulnerability can be verified using tools such as curl or Python requests. The server returns a session token even after excessive failed login attempts.
Example Request:
POST /api/login HTTP/1.1
Host: [Router_IP]
Content-Type: application/json
{"username": "admin", "password": "password_guess"}