A request sent from the local Wi‑Fi network to the Dbit WIFI4 N300 1.0.0 management interface that omits a required /api/login username or password field triggers a crash. The crash occurs because the device’s JSON parser processes the malformed input without proper validation, causing an internal error that brings down the management service. The resulting denial of service disables remote configuration, monitoring, and remote management until the device is reset, but does not provide any direct code execution or other privilege escalation.

All Dbit WIFI4 N300 devices running firmware version 1.0.0 are affected. The vulnerability is triggered only when an HTTP request containing the /api/login endpoint is received from any client on the local wireless network. No other vendors or product lines are known to share this specific issue.

Based on the description, it is inferred that an attacker must be within the same wireless network to send the malformed request, implying a local attack vector. No published exploits are listed in the CISA KEV catalog, and the EPSS score is <1%, indicating a low known exploitation probability at this time. The CVSS score of 9.8 reflects a high severity of the denial of service. The impact is confined to service interruption of the management interface; confidentiality and integrity are not directly compromised. Because the flaw arises from improper parsing of user input, it represents an input validation weakness (CWE‑20).