Description
Dbit WIFI4 N300 1.0.0 devices allows administrators (from the local Wi-Fi network) to execute OS commands by leveraging a stack-based buffer overflow via the /api/addStaticDHCP comment field,
Published: 2026-10-06
Score: 6.7 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A stack-based buffer overflow occurs in the /api/addStaticDHCP comment field, enabling administrators who are connected to the local Wi‑Fi network to execute arbitrary operating system commands on the device. This flaw can lead to full system compromise, granting attackers full control over the affected device.

Affected Systems

Dbit Wi‑Fi4 N300 1.0.0 devices are impacted. No other affected versions are listed.

Risk and Exploitability

The vulnerability is exploitable from the local network. The CVSS score of 6.7 indicates moderate severity, and the EPSS score of less than 1% implies a very low but nonzero current exploitation probability. The flaw is not listed in CISA KEV. Attackers with local Wi‑Fi network access can exploit the buffer overflow to execute commands, which may lead to full system compromise if the device is reachable.

Generated by OpenCVE AI on October 7, 2026 at 19:07 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Replace or update the device firmware to a version that addresses the buffer overflow.
  • Disable or restrict access to the /api/addStaticDHCP endpoint for local network administrators.
  • Implement network segmentation and restrict administrative access to trusted devices or management networks.

Generated by OpenCVE AI on October 7, 2026 at 19:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 07 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Title Stack-based Buffer Overflow Enables Local Administrator to Execute Arbitrary OS Commands via /api/addStaticDHCP

Wed, 07 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Title Stack-Based Buffer Overflow in DHCP API Allows Local Admins to Execute Arbitrary OS Commands
Weaknesses CWE-120

Wed, 07 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-121
Metrics cvssV3_1

{'score': 6.7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 07 Oct 2026 06:45:00 +0000

Type Values Removed Values Added
Title Stack-Based Buffer Overflow in DHCP API Allows Local Admins to Execute Arbitrary OS Commands
Weaknesses CWE-120

Tue, 06 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
Description Dbit WIFI4 N300 1.0.0 devices allows administrators (from the local Wi-Fi network) to execute OS commands by leveraging a stack-based buffer overflow via the /api/addStaticDHCP comment field,
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-10-07T14:11:51.776Z

Reserved: 2026-06-24T00:00:00.000Z

Link: CVE-2025-71384

cve-icon Vulnrichment

Updated: 2026-10-07T14:11:01.522Z

cve-icon NVD

Status : Deferred

Published: 2026-10-06T17:17:11.090

Modified: 2026-10-14T13:10:00.187

Link: CVE-2025-71384

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T19:15:14Z

Weaknesses
  • CWE-121

    Stack-based Buffer Overflow