CVE-2026-36957

Executive Summary

CVE-2026-36957 affects the Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router V1.0.0. The vulnerability resides in the boa web server URI handler and permits remote unauthenticated attackers to trigger a denial-of-service condition by sending a high-volume flood of HTTP GET requests to non-existent URIs. Successful exploitation exhausts file descriptors and memory buffers, resulting in kernel deadlock that disables the web management portal and all routing functions. The issue carries a CVSS 7.5 (High) score with no patch available from any tracked source.

Technical Analysis

The flaw is an instance of CWE-400 (Uncontrolled Resource Consumption). The boa web server on the affected router does not implement rate limiting, URI validation, or connection throttling for requests targeting non-existent paths. Each malformed GET request allocates a file descriptor and populates internal memory buffers. Under sustained high-volume traffic the kernel exhausts available descriptors and buffer pools, causing a deadlock that halts both the HTTP daemon and the routing stack. Attack surface is the WAN-facing TCP/80 interface. No authentication or session state is required, and the vector is network-reachable by design because the device exposes its management interface.

Exploitation Scenarios

1. Reconnaissance identifies the device via Shodan or masscan on port 80 returning a boa server banner and the Dbit N300 title string.
2. The attacker weaponizes a simple loop using curl or a lightweight Python script that issues thousands of GET requests per second to randomly generated non-existent URIs such as /a/b/c/ followed by a 32-character random string.
3. Payload execution consists of the continuous HTTP flood; each response returns 404 yet still consumes a descriptor and buffer.
4. Post-exploitation the router enters kernel deadlock, the management portal becomes unreachable, and all packet forwarding ceases, producing a complete device outage until manual power cycle.

Impact Assessment

Affected systems are limited to the single hardware model running firmware V1.0.0. Blast radius is high for environments that rely on the device for internet connectivity or remote management; all routing and VPN functions stop. CVSS subscores reflect network attack vector, low complexity, no privileges, and high availability impact with no confidentiality or integrity loss.

Detection Guidance

Sigma Rule

title: Dbit N300 Boa HTTP Flood DoS
id: dbit-2026-36957-001
status: experimental
description: Detects high volume of 404 responses from boa on Dbit router
logsource:
  category: webserver
  product: apache
detection:
  selection:
    c-uri-query|contains: '/'
    sc-status: 404
  timeframe: 10s
  condition: selection
fields:
  - client_ip
  - uri
falsepositives:
  - Legitimate scanning
level: high

YARA Rule

rule Dbit_N300_Boa_Flood {
    meta:
        description = "Detects flood patterns targeting non-existent URIs on Dbit boa server"
    strings:
        $uri = /GET \/[a-z0-9]{20,}/
        $ua = "User-Agent: curl"
    condition:
        $uri and $ua
}

Suricata IDS Rule

alert http any any -> $HOME_NET 80 (msg:"Dbit N300 Boa DoS Flood"; flow:to_server; http.method; content:"GET"; http.uri; content:!"index"; threshold:type both,track by_src,count 200,seconds 10; classtype:denial-of-service; sid:2026369571; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [http where http.request.method == "GET" and http.response.status_code == 404 and user_agent.original like "curl*"] with runs=200

Splunk SPL Query

index=web sourcetype=access_combined uri="*" status=404 useragent="curl*" 
| bucket span=10s _time 
| stats count by src_ip _time 
| where count > 200

Wazuh OSSEC Rule

<rule id="202291" level="12">
  <if_sid>31100</if_sid>
  <match>GET /.* HTTP/1.1" 404</match>
  <description>Dbit N300 boa flood detected</description>
  <group>web,DoS,</group>
</rule>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations: place the device behind a stateful firewall that rate-limits HTTP requests to TCP/80 to 10 per minute per source IP and drops connections lacking a valid Host header.
2. Patch/upgrade steps: none available; monitor vendor site for firmware updates.
3. Long-term hardening: disable WAN management, migrate to a supported router model, and implement network segmentation so the device is not reachable from untrusted networks.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-36957
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-36957
https://www.cisa.gov/known-exploited-vulnerabilities-catalog (no entry)
Researcher disclosure on boa web server resource exhaustion patterns (2025 blog post)
No known threat actor campaigns or in-the-wild exploitation recorded as of current EPSS percentile.