Description
A stack-based buffer overflow vulnerability in the Dbit T-CPE301K 4G WiFi minirouter allows an authenticated attacker to cause a denial of service (DoS) and a system reboot via a manipulated HTTP POST request directed at the endpoint ‘/js/common/do_cmd.js’ endpoint containing an excessively long parameter, which overwrites the PC and RA registers.
Published: 2026-09-29
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service and System Reboot via Buffer Overflow
Action: Monitor
AI Analysis

Impact

The vulnerability is a stack‑based buffer overflow that allows an authenticated attacker to send a specially crafted HTTP POST request to the /js/common/do_cmd.js endpoint. The overly long parameter overwrites the PC and RA registers, causing the router to crash and reboot, resulting in denial of service.

Affected Systems

This issue affects all models of the Shenzhen Dbit Network Equipment T‑CPE301K 4G Mini WiFi Router. No specific firmware version details are provided, indicating that the flaw could exist in every currently deployed unit.

Risk and Exploitability

With a CVSS score of 9.3 the flaw is considered critical. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authentication to the router, so the attacker must have local network or remote administrative access. If exploited, repeated crashes would interrupt network connectivity and force restarts, potentially leading to prolonged downtime.

Generated by OpenCVE AI on September 30, 2026 at 02:46 UTC.

Remediation

Vendor Solution

No solution has been reported as yet.

OpenCVE Recommended Actions

  • Apply any firmware update or patch released by Shenzhen Dbit Network Equipment once available.
  • Disable remote management or restrict access to the /js/common/do_cmd.js endpoint by configuring the router’s access control or firewall rules.
  • Monitor the router’s access logs for unusual POST requests to /js/common/do_cmd.js and block the offending IP addresses.
  • Segment the network to isolate the router from critical infrastructure to limit the impact of a reboot.

Generated by OpenCVE AI on September 30, 2026 at 02:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 29 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 13:15:00 +0000

Type Values Removed Values Added
Description A stack-based buffer overflow vulnerability in the Dbit T-CPE301K 4G WiFi minirouter allows an authenticated attacker to cause a denial of service (DoS) and a system reboot via a manipulated HTTP POST request directed at the endpoint ‘/js/common/do_cmd.js’ endpoint containing an excessively long parameter, which overwrites the PC and RA registers.
Title Multiple vulnerabilities in the T-CPE301K 4G Mini WiFi Router from Shenzhen Dbit Network Equipment
First Time appeared Shenzhen Dbit Network Equipment
Shenzhen Dbit Network Equipment t-cpe301k 4g Mini Wifi Router
Weaknesses CWE-121
CPEs cpe:2.3:a:shenzhen_dbit_network_equipment:t-cpe301k_4g_mini_wifi_router:*:*:*:*:*:*:*:*
Vendors & Products Shenzhen Dbit Network Equipment
Shenzhen Dbit Network Equipment t-cpe301k 4g Mini Wifi Router
References
Metrics cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Shenzhen Dbit Network Equipment T-cpe301k 4g Mini Wifi Router
cve-icon MITRE

Status: PUBLISHED

Assigner: INCIBE

Published:

Updated: 2026-09-29T14:37:35.047Z

Reserved: 2026-04-27T13:40:23.725Z

Link: CVE-2026-7192

cve-icon Vulnrichment

Updated: 2026-09-29T14:37:31.737Z

cve-icon NVD

Status : Deferred

Published: 2026-09-29T13:17:52.447

Modified: 2026-09-29T21:35:31.350

Link: CVE-2026-7192

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T20:42:10Z

Weaknesses
  • CWE-121

    Stack-based Buffer Overflow