Interactive teardown
Inside the T-CPE301K: Two CVEs in a 4G Mini Router
In development: an interactive teardown of the Dbit T-CPE301K and the path to CVE-2026-7192 and CVE-2026-7193.
The 3D model is unavailable in this browser. The article is complete without it.
TL;DR
The Dbit T-CPE301K 4G Mini WiFi Router exposed two separate security failures: a stack-based buffer overflow in its web-management path (CVE-2026-7192, CVSS v4.0 9.3) and hard-coded credentials that provided root access over Telnet (CVE-2026-7193, CVSS v4.0 8.6).
Opening the device
In development. Meanwhile, watch the router being opened at 1:58.
The UART header
In development. Meanwhile, the video finds the UART pins and reads the boot log from 3:13.
The SPI flash
In development. Meanwhile, the video dumps the BH25D16A and hashes the image from 8:40.
Mapping the attack surface
In development. Meanwhile, the video explains what eCos changes about the attack surface at 14:02.
CVE-2026-7192: Stack-based buffer overflow
In development…
CVE-2026-7193: Hard-coded Telnet credentials
In development…
Remediation
In development…
Disclosure
- 15 September 2025: The coordinated disclosure process began with INCIBE-CERT.
- 29 September 2026: INCIBE-CERT published the coordinated advisory (INCIBE-2026-671) and both CVE records.
- 22 October 2026: Interactive research page prepared for publication.
Authoritative advisory: INCIBE-CERT — Multiple vulnerabilities in the T-CPE301K 4G Mini WiFi Router.