CVE-2026-19901
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A security flaw has been discovered in LB-LINK X-PRO 1.0.22-20231206. An unknown function of the file /etc/config/easycwmp is affected. The manipulation results in hard-coded credentials. Remote attack is possible but highly complex and difficult to exploit. The exploit has been released publicly and may be used. The vendor was contacted but did not respond.
Risk Assessment
Risk of unauthorized device access using default credentials, potentially enabling device and network compromise.
Recommendation
Change default credentials to unique and strong ones. Restrict remote access to the device. Contact the vendor for patches.
Original NVD description (English source)
A security flaw has been discovered in LB-LINK X-PRO 1.0.22-20231206. This affects an unknown function of the file /etc/config/easycwmp. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is reported as difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.