CVE-2025-65427 describes a vulnerability in the Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router firmware version 1.0.0. The issue is the absence of rate limiting on the /api/login endpoint, enabling attackers to conduct brute force attacks to enumerate passwords. This vulnerability is categorized under CWE-307 (Improper Restriction of Excessive Authentication Attempts). The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and impacts on confidentiality and integrity.

An attacker can repeatedly attempt to authenticate via the /api/login API without restriction, potentially allowing them to discover valid credentials through brute force. This compromises the confidentiality and integrity of the device's authentication mechanism. There is no impact on availability reported. No known exploits are currently documented in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to implement external protections such as network-level rate limiting or access controls to restrict login attempts. Monitoring for unusual login activity may also help detect brute force attempts.