---
id: CVE-2026-79589
title: >-
  The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure
  access control flaw that allows an attacker to gain unauthenticated root shell
summary: >-
  The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure
  access control flaw that allows an attacker to gain unauthenticated root
  shell. The vulnerability is caused by the exposure of the UART debugging
  interface havi…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: adp
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-11-03T00:16:00.557515Z'
exploitAvailable: true
published: '2026-10-29'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T00:17:32.264Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-79589'
references:
  - url: >-
      https://www.u-speed.com.cn/en/product_details?production=N300&production_miaoshu=1%E6%89%9816%E4%B8%BB%E5%85%89%E7%8C%AB%2C%E4%BC%81%E4%B8%9A%E5%85%A8%E5%85%89%E4%B8%A4%E5%8D%83%E5%85%86%E6%8E%A5%E5%85%A5
  - url: 'https://github.com/milkinit/cve-disclosures/tree/main/IoT/CVE-2026-79589'
tags:
  - cve.org
  - exploit-available
epss: 0.00345
epssPercentile: 0.28313
ingestedAt: '2026-11-01T20:00:16.928Z'
---

## Overview

The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure access control flaw that allows an attacker to gain unauthenticated root shell. The vulnerability is caused by the exposure of the UART debugging interface having a lack of authentication, authorization and access control functionality. Once the interface is soldered and connected to the attacker, they gain root privilege to the system.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.