A Cross‑Site Request Forgery vulnerability allows an attacker to craft a malicious web page that forces an authenticated administrator’s browser to send forged HTTP requests to the router’s administrative API endpoints. The router accepts these requests without verifying anti‑CSRF tokens or enforcing Origin/Referer checks, so the attacker can manipulate configuration settings such as Wi‑Fi parameters. This flaw can lead to unauthorized changes that compromise network security without requiring any local presence or credentials beyond a legitimate admin session.

The vulnerability affects the Dbit N300 T1 Pro wireless router running firmware version V1.0.0. No other vendors or product versions are listed as impacted.

Because the attack requires only a malicious web page and relies on the victim’s authenticated session cookie, the risk of compromise is high for administrators who access the interface from the web. The exploit is straightforward with no specialized prerequisites, and the router lacks mitigation such as anti‑CSRF tokens. The CVSS score of 8.8 indicates high severity, the EPSS score is not available, and the issue is not listed in CISA KEV, so the straightforward nature of the flaw warrants immediate attention.