CVE-2026-79589
Deferred Deferred - Pending Action

Unauthenticated Root Access in U-speed WIFI4 N300 Router

Publication date: 2026-10-29

Last updated on: 2026-10-29

Assigner: MITRE

Description
The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure access control flaw that allows an attacker to gain unauthenticated root shell. The vulnerability is caused by the exposure of the UART debugging interface having a lack of authentication, authorization and access control functionality. Once the interface is soldered and connected to the attacker, they gain root privilege to the system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-29
Last Modified
2026-10-29
Generated
2026-10-29
AI Q&A
2026-10-29
EPSS Evaluated
N/A
NVD
CVE-2026-79589
EUVD
EUVD-2026-112934

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a n/a n/a

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an insecure access control flaw in the U-speed N300 WIFI4 Router (Model: T1 Pro) v1.0.0. It involves an exposed UART debugging interface that lacks authentication, allowing attackers with physical access to gain an unauthenticated root shell with full system control.

Detection Guidance

Check for exposed UART test pads on the WIFI4 N300 router (Model: T1 Pro) v1.0.0. Connect to the interface at a baud rate of 38400 using a serial terminal like screen or minicom. If you gain root shell access without authentication, the vulnerability is present.

Impact Analysis

An attacker with physical access to the router can exploit this flaw to gain root privileges, enabling them to read or modify sensitive data, install malware, or disrupt network operations. This could lead to data breaches, unauthorized network access, or complete device compromise.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA if it results in unauthorized access to personal or health data. Organizations using this router may fail to meet data protection requirements due to inadequate security controls.

Mitigation Strategies

Disable the UART ports physically or via firmware updates. Implement strong authentication mechanisms for the UART interface. Ensure the device is not accessible to unauthorized physical access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79589. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart