CVE-2025-71384 in WIFI4 N300
Summary
by MITRE • 10/06/2026
Dbit WIFI4 N300 1.0.0 devices allows administrators (from the local Wi-Fi network) to execute OS commands by leveraging a stack-based buffer overflow via the /api/addStaticDHCP comment field,
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified in Dbit WIFI4 N300 version 1.0.0 represents a critical security flaw rooted in improper input validation and memory management within the device's web administration interface. Specifically, this issue manifests as a stack-based buffer overflow located in the processing logic for the /api/addStaticDHCP endpoint. This API function is responsible for configuring static DHCP reservations on the router, allowing administrators to assign fixed IP addresses to specific MAC addresses. The core technical failure occurs when the application fails to adequately check the length of user-supplied data before copying it into a fixed-size buffer on the stack. When an administrator submits a comment field with input exceeding the expected limit, the excess data overwrites adjacent memory locations on the call stack, including critical control flow information such as return addresses and saved frame pointers.
From a technical perspective, this flaw aligns directly with CWE-120, which classifies buffer copies without checking size limits for improper memory allocation. The exploitation of this vulnerability requires an attacker to be authenticated as an administrator and connected to the local Wi-Fi network, indicating that it is not remotely exploitable over the internet but poses a severe threat to any user who connects their device to the router's wireless or wired LAN interface. By carefully crafting the payload within the comment field, an attacker can overwrite the return address with shellcode or pointers to existing executable code in memory. This allows for arbitrary command execution on the underlying operating system of the network appliance, effectively granting full control over the device.
The operational impact of this vulnerability is significant due to its potential for lateral movement and persistent access within a local network environment. Once an attacker achieves remote code execution via this buffer overflow, they can compromise not only the router itself but also any other devices on the same subnet that rely on it for connectivity or DNS resolution. The compromised device can be used as a pivot point for further attacks against internal servers, workstations, and IoT devices. Furthermore, because the vulnerability requires local network access, it is particularly dangerous in environments where physical security of endpoints is weak or when untrusted users have temporary Wi-Fi access privileges. This scenario corresponds to MITRE ATT&CK techniques related to Initial Access via valid accounts and Execution through command scripting, highlighting the risk posed by insider threats or compromised client devices within a trusted network boundary.
Mitigation strategies for this vulnerability primarily involve applying vendor-provided firmware updates that patch the buffer overflow issue in the /api/addStaticDHCP handler. If an update is not immediately available, administrators should restrict access to the management interface by disabling remote administration features and ensuring that only authorized users have administrative credentials. Additionally, implementing network segmentation can limit the blast radius of a successful exploitation attempt by isolating critical infrastructure from general user Wi-Fi networks. Security monitoring tools should be configured to detect anomalous traffic patterns or unauthorized configuration changes on the router's API endpoints as an interim defensive measure until the underlying code defect is resolved through proper input sanitization and bounds checking in future software releases.