The U‑SPEED N300 router (firmware v1.0.0) does not enforce rate limiting or lockout mechanisms on its /api/login endpoint. An attacker who can reach the local network can send unlimited authentication attempts, enabling brute‑force attacks against the administrator account and potentially gaining unauthorized access to the router’s management interface.

U‑SPEED N300 router, firmware version 1.0.0.

This flaw allows a local attacker to perform unlimited login attempts, raising the likelihood of a successful brute‑force attack. The CVSS score of 7.5 indicates a high severity, and with no public exploit reference and an unavailable EPSS score, the exact exploitation probability remains unknown. The vulnerability could lead to full administrative control of the device. Because the router is not listed in CISA’s KEV catalog, no documented current exploitation is known, but the risk remains high for devices on an unsecured local network.