CVE-2026-36956 describes a CSRF vulnerability in the Dbit N300 T1 Pro wireless router V1.0.0. The vulnerability arises because the router's web management interface lacks adequate CSRF protections on administrative API endpoints like /api/setWlan. An attacker can exploit this by tricking an authenticated administrator into visiting a malicious webpage that sends forged requests including the administrator's valid session cookie, leading to unauthorized administrative actions on the router.

Successful exploitation can lead to unauthorized configuration changes on the affected router, impacting confidentiality, integrity, and availability of the device. The attacker can cause the router to perform administrative actions without the administrator's consent, potentially disrupting network operations or compromising network security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid visiting untrusted webpages while authenticated to the router's management interface. Network administrators should monitor for unusual configuration changes and consider additional network-level protections to limit exposure.