{"id":"CVE-2025-71383","published":"2026-10-06T17:17:10.953","lastModified":"2026-10-08T03:16:32.637","description":"Dbit WIFI4 N300 1.0.0 devices allow the management interface to be crashed via a request (from the local Wi-Fi network) that lacks a /api/login username or password field. This occurs because of an error in a JSON parser.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-20"],"vendors":[],"products":[],"references":[{"url":"https://www.klogixsecurity.com/scorpion-labs-blog/anatomy-of-an-iot-exploit-from-hands-on-to-rce-folie-a-deux","tags":[]},{"url":"https://www.klogixsecurity.com/scorpion-labs-blog/anatomy-of-an-iot-exploit-from-hands-on-to-rce-folie-a-deux","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows the management interface of Dbit WIFI4 N300 1.0.0 devices to crash via a local Wi-Fi request missing the username or password field, due to an error in the JSON parser.","exploitability":"Exploitation is relatively easy as it requires only a local Wi-Fi network access and a crafted request without the necessary fields.","blast_radius":"If exploited, this could lead to a complete denial of service for the management interface, impacting device management and configuration.","remediation":"Disable the affected feature or restrict access to the management interface to prevent unauthorized requests.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["dos","json-parser","local-exploit"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-08T08:40:37.445Z"}}