Vulnerability · Published Aug 28, 2026 · Assigned by CERT-In

CVE-2026-19412Hardcoded Credentials Vulnerability in CP Plus CP-XR-DE21-S Router

High 8.7

In plain English

A high-severity hard-coded credentials in CP-XR-DE21-S Router from CP Plus. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.3%top 77.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

This vulnerability exists in the CP Plus CP-XR-DE21-S Router due to the presence of hardcoded HTTP Digest authentication credentials in the firmware that are identical across all devices running the affected firmware. An attacker with access to the local network could exploit this vulnerability by obtaining the hardcoded authentication information from the firmware. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized administrative access and perform privileged operations on the targeted device.

Affected products (as reported)

Vendor	Product	Versions
CP Plus	CP-XR-DE21-S Router	version 1.057.043_0027 or below

Weakness: CWE-798 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0428 third-party-advisory