Live › vulnerability › CVE-2026-79589
The U-speed WIFI4 N300 router (model T1 Pro, v1.0.0) exposes a UART debug interface with no authentication or access control. Anyone who connects to that interface gets a root shell on the device.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 14:25 UTC. All times on this page are UTC.
Owners of the U-speed WIFI4 N300 T1 Pro running v1.0.0. Exploitation needs physical access: someone must open the router and solder wires to the UART test pads, so the risk is for routers in shared or public places, or ones that pass through untrusted hands (resale, shipping, hotel or office). Remote attackers cannot use this, and other models are not covered by this CVE.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| U-speed WIFI4 N300 T1 Pro | hardware | v1.0.0 | – |
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure access control flaw that allows an attacker to gain unauthenticated root shell. The vulnerability is caused by the exposure of the UART debugging interface having a lack of authentication, authorization and access control functionality. Once the interface is soldered and connected to the attacker, they gain root privilege to the system.
This page as .md · .json · in your agent: get_signal("CVE-2026-79589")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.