CVE-2026-7192

Multiple vulnerabilities in the T-CPE301K 4G Mini WiFi Router from Shenzhen Dbit Network Equipment

Published Sep 29, 2026 CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Description

A stack-based buffer overflow vulnerability in the Dbit T-CPE301K 4G WiFi minirouter allows an authenticated attacker to cause a denial of service (DoS) and a system reboot via a manipulated HTTP POST request directed at the endpoint ‘/js/common/do_cmd.js’ endpoint containing an excessively long parameter, which overwrites the PC and RA registers.

Analysis

Technical impact

The vulnerability is a stack‑based buffer overflow that allows an authenticated attacker to send a specially crafted HTTP POST request to the /js/common/do_cmd.js endpoint. The overly long parameter overwrites the PC and RA registers, causing the router to crash and reboot, resulting in denial of service.

Affected Systems

This issue affects all models of the Shenzhen Dbit Network Equipment T‑CPE301K 4G Mini WiFi Router. No specific firmware version details are provided, indicating that the flaw could exist in every currently deployed unit.

Risk and Exploitability

With a CVSS score of 9.3 the flaw is considered critical. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authentication to the router, so the attacker must have local network or remote administrative access. If exploited, repeated crashes would interrupt network connectivity and force restarts, potentially leading to prolonged downtime.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Shenzhen Dbit Network Equipment

T-CPE301K 4G Mini WiFi Router

unaffected

Version	Status	Constraints
`0`	affected	< 29/09/2026

No data.

Vendor Product Versions

Shenzhen Dbit Network Equipment

T-cpe301k 4g Mini Wifi Router

Version	Status	Scheme	Platform
`[0,29/09/2026)`	affected	generic	—

Remediation

Vendor Solution

No solution has been reported as yet.

OpenCVE Recommended Actions

Apply any firmware update or patch released by Shenzhen Dbit Network Equipment once available.
Disable remote management or restrict access to the /js/common/do_cmd.js endpoint by configuring the router’s access control or firewall rules.
Monitor the router’s access logs for unusual POST requests to /js/common/do_cmd.js and block the offending IP addresses.
Segment the network to isolate the router from critical infrastructure to limit the impact of a reboot.

Generated by OpenCVE AI on September 30, 2026 at 02:46 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.257% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-t-cpe301k-4g-mini-wifi-router-shenzhen-dbit

History

Sep 29, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 29, 2026 1:15 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A stack-based buffer overflow vulnerability in the Dbit T-CPE301K 4G WiFi minirouter allows an authenticated attacker to cause a denial of service (DoS) and a system reboot via a manipulated HTTP POST request directed at the endpoint ‘/js/common/do_cmd.js’ endpoint containing an excessively long parameter, which overwrites the PC and RA registers.
Title		Multiple vulnerabilities in the T-CPE301K 4G Mini WiFi Router from Shenzhen Dbit Network Equipment
First Time appeared		Shenzhen Dbit Network Equipment Shenzhen Dbit Network Equipment t-cpe301k 4g Mini Wifi Router
Weaknesses		CWE-121
CPEs		cpe:2.3:a:shenzhen_dbit_network_equipment:t-cpe301k_4g_mini_wifi_router::::::::
Vendors & Products		Shenzhen Dbit Network Equipment Shenzhen Dbit Network Equipment t-cpe301k 4g Mini Wifi Router
References		https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-t-cpe301k-4g-mini-wifi-router-shenzhen-dbit
Metrics		cvssV4_0 `{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`