The vulnerability arises from the use of predefined credentials in the Dbit T-CPE301K 4G Mini WiFi Router, allowing an attacker on the same local network to log in to the device’s Telnet service (port 23) using static default accounts. Once authenticated, the attacker obtains full root privileges, providing the ability to execute arbitrary commands, compromise data confidentiality and integrity, and potentially use the router as a foothold for further network attacks. The weakness is classified as CWE‑798, highlighting the security risk of default or hard‑coded credentials.

The impacted device is the Shenzhen Dbit Network Equipment T-CPE301K 4G Mini WiFi Router. No specific firmware or model variants are listed beyond the product name, and version information is currently unavailable.

The assessment gives a CVSS score of 8.6, indicating a high severity. No EPSS data is published, so the current exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. Exploitation is likely to occur from a local attacker with network connectivity to the device, exploiting an open Telnet port and leveraging the available default credentials. If this service remains exposed, an adversary can achieve complete device compromise without additional privileges or complex attacks.