Vulnerability · Published Aug 17, 2026 · Assigned by VulDB

CVE-2026-19971LB-Link WR1210M Backup Endpoint backup.cgi main missing authentication

Medium 4.7

In plain English

A medium-severity missing authentication in WR1210M from LB-Link. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)4.7Medium

Exploit odds (30 days)0.4%top 63.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

A flaw has been found in LB-Link WR1210M 1.0.3. This impacts the function main of the file /www/cgi-bin/backup.cgi of the component Backup Endpoint. This manipulation causes missing authentication. The attack is only possible within the local network. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
LB-Link	WR1210M	1.0.3

Weakness: CWE-306, CWE-287 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N/E:X/RL:X/RC:R

References

VDB-391148 | LB-Link WR1210M Backup Endpoint backup.cgi main missing authentication vdb-entry, technical-description
VDB-391148 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
CVE-2026-19971 | CVE Analysis and Report third-party-advisory
Submit #873139 | LB-LINK WR1210M V3.0 Firmware V1.0.3 Missing Authentication third-party-advisory