CVE-2026-36959 identifies a vulnerability in the U-SPEED N300 router V1.0.0 where the /api/login endpoint does not enforce rate limiting or account lockout mechanisms. This absence permits an attacker on the local network to attempt unlimited login attempts, increasing the risk of brute-force attacks against the administrator credentials and potential unauthorized control over the router management interface. The vulnerability is published but lacks a CVSS score and vendor remediation details.

An attacker on the local network can perform unlimited authentication attempts against the router's login API, increasing the likelihood of successfully guessing administrator credentials. Unauthorized access to the router management interface could compromise network configuration and security. No evidence of active exploitation is currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local network access to trusted users only and monitor for suspicious login attempts. Consider changing default credentials and using strong passwords to reduce brute-force success likelihood.