Read the docs
TI-2026-06312 Aliases CVE-2026-7192GHSA-r22p-w9qg-87mw

Multiple vulnerabilities in the T-CPE301K 4G Mini WiFi Router from Shenzhen Dbit Network Equipment

Priority MEDIUM 48CWE-121Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

A stack-based buffer overflow vulnerability in the Dbit T-CPE301K 4G WiFi minirouter allows an authenticated attacker to cause a denial of service (DoS) and a system reboot via a manipulated HTTP POST request directed at the endpoint ‘/js/common/do_cmd.js’ endpoint containing an excessively long parameter, which overwrites the PC and RA registers.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00257 17th percentileScored 2026-11-07
Fix Fixed T-CPE301K 4G Mini WiFi Router (Shenzhen Dbit Network Equipment): 29/09/2026

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Shenzhen Dbit Network EquipmentT-CPE301K 4G Mini WiFi Routerbefore 29/09/202629/09/2026Patch availableCNA

Remediation

  • Fix · CNA T-CPE301K 4G Mini WiFi Router (Shenzhen Dbit Network Equipment) Fixed in 29/09/2026

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Shenzhen Dbit Network Equipment T-CPE301K 4G Mini WiFi Router 29/09/2026

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-06313 Multiple vulnerabilities in the T-CPE301K 4G Mini WiFi Router from Shenzhen Dbit Network EquipmentPriority LOW 39
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-7192
  2. 2026-10-03 Alias added: GHSA-r22p-w9qg-87mw

References

Patch 1

  • TI-2026-06313 Multiple vulnerabilities in the T-CPE301K 4G Mini WiFi Router from Shenzhen Dbit Network Equipment CVSS 4.0HIGH 8.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences