The Dbit N300 T1 Pro wireless router contains a critical CSRF vulnerability that enables unauthenticated attackers to execute arbitrary administrative actions via a victim's active session.

The device lacks anti-CSRF tokens and proper request validation on administrative API endpoints, such as /api/setWlan. An attacker can force an authenticated administrator's browser to execute unauthorized configuration changes by enticing the user to visit a malicious webpage.

Successful exploitation allows an attacker to modify critical router configurations, which could lead to complete device compromise, interception of network traffic, or unauthorized access to internal network resources. With a CVSS score of 8.8, this vulnerability poses a significant risk to organizational infrastructure, as it facilitates remote management of the device by unauthorized parties.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the web management interface to trusted IP addresses only and disable remote management features.

Proactive Monitoring: Monitor network access logs for suspicious requests originating from internal administrative sessions or unexpected traffic patterns directed at configuration endpoints.

Compensating Controls: Implement an egress filtering policy and ensure that administrative users do not browse untrusted websites while logged into the router's management console.

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the researcher's GitHub repository.

Given the lack of a vendor-provided patch, users must treat this device as high risk. Organizations should immediately isolate the management interface from the public internet and enforce strict access control lists to prevent unauthorized exploitation of this flaw.