CVE-2026-36959 affects U-SPEED N300 router version 1.0.0 by not implementing rate limiting or account lockout on the /api/login endpoint. This absence enables an attacker with local network access to perform unlimited login attempts, increasing the risk of brute-force attacks against the administrator account. The vulnerability allows potential unauthorized access to the router management interface. No official patch or remediation guidance is currently available.

An attacker on the local network can repeatedly attempt to authenticate without restriction, increasing the likelihood of successfully guessing the administrator password. This could lead to unauthorized administrative access to the router, compromising device configuration and network security. The vulnerability does not impact confidentiality, integrity, or availability directly beyond unauthorized access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local network access to trusted users only and monitor for suspicious login attempts. Consider changing default credentials to strong, unique passwords to reduce brute-force success likelihood.