The vulnerability permits a Cross‑Site Request Forgery against the U‑SPEED N300 Router’s web management interface. The device does not use anti‑CSRF tokens or strict Origin/Referer validation for its administrative API endpoints, letting a malicious webpage forge HTTP requests. If an authenticated administrator visits such a page, the browser includes the valid session cookie and the router executes the request as a legitimate administrative action, potentially altering configuration without the administrator’s intent. This can lead to loss of network control or service disruption.

The affected product is the U‑SPEED N300 Router running firmware version V1.0.0. No other vendors or versions are reported in the data.

The CVSS score of 8.8 indicates high severity, while the EPSS score is not available and the vulnerability is not listed in KEV. An attacker must lure a legitimate administrator into visiting a malicious web page to trigger the forged request, as the router accepts any authenticated session cookie without CSRF protection. Once the admin is deceived, the attacker can alter configuration, potentially compromising network control or service availability, with minimal effort beyond social engineering.