The U-speed WIFI4 N300 T1 Pro v1.0.0 accepts administrative credentials over an unencrypted HTTP channel. When an administrator logs in, the username and password are sent in cleartext, enabling any network observer to capture them. This flaw corresponds to CWE-319: Cleartext Transmission of Sensitive Information. Exposure of these credentials allows full control of the device, enabling configuration changes, malicious firmware installation, or pivoting to other network assets. The vulnerability affects confidentiality and may also compromise integrity of the device’s management interface.

Devices running the U-speed WIFI4 N300 T1 Pro firmware version 1.0.0 are impacted. No other versions or models are mentioned in the available information.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of <1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. It can be reached via local network traffic interception or by an attacker with physical or wireless access to the router’s management interface. Once credentials are captured, an attacker can log in and fully control the device. No vendor mitigation or patch is reported, so the risk persists until firmware is updated to enforce HTTPS or otherwise protect credential transmission.