by Kastro
Paper/Archive/CVE-2026-19901

CVE-2026-19901

LB-LINK X-PRO — LB-LINK X-PRO easycwmp hard-coded credentials

EPSS 0.8%public exploitCVSS 9.2
critical.is priorityof 100
49
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 55.5.555 × 2011.1Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A security flaw has been discovered in LB-LINK X-PRO 1.0.22-20231206. This affects an unknown function of the file /etc/config/easycwmp. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is reported as difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Affected

ProductAffectedFixed inSource
X-PRO1.0.22-20231206–CNA

Scores by source

VulDB (CNA)9.2CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
VulDB (CNA)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
VulDB (CNA)8.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refvuldb.com/vuln/390091refvuldb.com/vuln/390091/ctiwriteupvuldb.com/cve/CVE-2026-19901writeupvuldb.com/submit/870763exploitgithub.com/DavCloudz/cve/blob/main/B-Link/Hardcoded%20TR-069%20(easycwmp)%20Remote%20Management%20Credentials.md