Log in Start free

Vulnerability · Published Aug 15, 2026 · Assigned by VulDB

CVE-2026-19900LB-LINK X-PRO shadow hard-coded credentials

High 8.1

In plain English

A high-severity hard-coded credentials in X-PRO from LB-LINK. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.9% (higher than 87% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)2.9%top 12.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling2Nuclei, Public PoC

Official description

A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206. The impacted element is an unknown function of the file /etc/shadow. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. A high degree of complexity is needed for the attack. The exploitability is regarded as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

VendorProductVersions
LB-LINK X-PRO 1.0.22-20231206

Weakness: CWE-798, CWE-259 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R

References