{"id":"CVE-2026-79589","kind":"vulnerability","aliases":["CVE-2026-79589"],"related":[],"title":"U-speed WIFI4 N300 T1 Pro router: exposed UART gives unauthenticated root shell","description":"The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure access control flaw that allows an attacker to gain unauthenticated root shell. The vulnerability is caused by the exposure of the UART debugging interface having a lack of authentication, authorization and access control functionality. Once the interface is soldered and connected to the attacker, they gain root privilege to the system.","summary":"The U-speed WIFI4 N300 router (model T1 Pro, v1.0.0) exposes a UART debug interface with no authentication or access control. Anyone who connects to that interface gets a root shell on the device.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"U-speed WIFI4 N300 T1 Pro","fixed":[],"affected":"v1.0.0","ecosystem":"hardware"}],"ecosystems":[],"tags":["infrastructure","iot","physical-access","router","t1-pro","u-speed","uart","wifi4-n300"],"not_affected_if":["no-physical-access","other-models"],"how_to_check":"- Model T1 Pro (U-speed WIFI4 N300), firmware v1.0.0 (how to read the version is not stated in the sources).\n- Open the case and look for UART test pads; the researcher connected at 38400 baud and got a root shell with no login. Anyone with physical access can do this.","fix":null,"status":"open","published_at":"2026-10-29T14:17:59+00:00","first_seen_at":"2026-10-29T14:25:23+00:00","triaged_at":"2026-10-29T14:26:21+00:00","updated_at":"2026-10-29T14:27:49+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-29T14:26:21Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"U-speed WIFI4 N300 T1 Pro router: exposed UART gives unauthenticated root shell","impact":"high","summary":"The U-speed WIFI4 N300 router (model T1 Pro, v1.0.0) exposes a UART debug interface with no authentication or access control. Anyone who connects to that interface gets a root shell on the device.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["u-speed","wifi4-n300","t1-pro","router","iot"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker gains root shell on the router after connecting to UART","analyst_note":"Check the NVD entry and the vendor's advisory for a firmware fix and whether the UART pads are populated on production units.","how_to_check":"- Check whether the device model is T1 Pro and the firmware is v1.0.0 (unknown how to read the version from the device; the sources do not say).\n- Inspect the circuit board for an exposed UART serial header or solder pads that connect to it.","plain_action":"","needs_analyst":true,"not_affected_if":["other-models","no-physical-access"],"who_is_affected":"Owners of the U-speed WIFI4 N300 T1 Pro router running v1.0.0 are affected. Exposure requires physical access to the board's UART interface, so the risk is mainly for devices in places where someone could reach the hardware. The sources do not say whether a firmware update exists.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000698,"input_tokens":4166,"output_tokens":562,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Check the NVD entry and the vendor's advisory for a firmware fix and whether the UART pads are populated on production units.","search":"'-2026':16A,19A '-79589':17A,20A 'access':32B,64B,94C,125C 'allow':98C 'anyon':66B 'attack':100C,137C 'authent':62B,122C 'author':123C 'caus':109C 'connect':68B,134C 'contain':91C 'control':65B,95C,126C 'cve':15A,18A 'debug':58B,116C 'devic':78B 'expos':9A,55B 'exposur':112C 'flaw':96C 'function':127C 'gain':102C,139C 'get':72B 'give':11A 'infrastructur':28B 'insecur':93C 'interfac':59B,71B,117C,130C 'iot':29B 'lack':120C 'model':51B,83C 'n300':5A,25A,43B,49B,81C 'physic':31B 'physical-access':30B 'privileg':141C 'pro':7A,27A,36B,53B,85C 'root':13A,74B,104C,140C 'router':8A,33B,50B,82C 'shell':14A,75B,105C 'solder':132C 'speed':3A,23A,39B,47B,90C 'system':144C 't1':6A,26A,35B,52B,84C 't1-pro':34B 'u':2A,22A,38B,46B,89C 'u-spe':1A,37B,45B,88C 'u-speed':21A 'uart':10A,40B,57B,115C 'unauthent':12A,103C 'v1.0.0':54B,86C 'vulner':107C 'wifi4':4A,24A,42B,48B,80C 'wifi4-n300':41B","nicknames":[],"mitigations":[],"who_affected":"Owners of the U-speed WIFI4 N300 T1 Pro running v1.0.0. Exploitation needs physical access: someone must open the router and solder wires to the UART test pads, so the risk is for routers in shared or public places, or ones that pass through untrusted hands (resale, shipping, hotel or office). Remote attackers cannot use this, and other models are not covered by this CVE.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T14:17:59+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-79589","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79589","severity":null,"published_at":"2026-10-29T14:17:59+00:00","modified_at":"2026-10-29T14:17:59+00:00","first_seen_at":"2026-10-29T14:25:23+00:00","fetched_at":"2026-10-29T14:25:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-79589:1031","url":null,"severity":null,"published_at":"2026-10-29T14:27:49+00:00","modified_at":"2026-10-29T14:27:49+00:00","first_seen_at":"2026-10-29T14:27:49+00:00","fetched_at":"2026-10-29T14:27:49+00:00","note":"Only the researcher's GitHub disclosure (milkinit) found; no vendor advisory, no firmware fix located, NVD page returned nothing via web-cli. Researcher remediation: disable UART / add auth. Fix status left unknown (no vendor page saying none). Nothing verified. Sibling CVE-2026-79588 (cleartext HTTP creds) same device."}],"documents":[{"id":17056,"url":"https://github.com/milkinit/cve-disclosures/tree/main/IoT/CVE-2026-79589","title":"milkinit disclosure: U-speed T1 Pro UART root shell","kind":"poc","source":"analyst","publisher":null,"text":"Researcher write-up: U-speed N300 WIFI4 (T1 Pro) v1.0.0 UART test pads, baud 38400, unauthenticated root (UID 0) shell. Physical access, CWE-306. Remediation: disable UART and/or add authentication. Screenshots poc.jpg, poc2.jpg.","published_at":null,"relation":"poc","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}