Vulnerability · Published Jul 30, 2026 · Assigned by VulnCheck
CVE-2026-67596CSL 1010 M2M 3G WiFi Module 2.2.1.4 Weak Encryption via Router.cfg
Medium 6.2
In plain English
A medium-severity security flaw in CSL 1010 M2M 3G WiFi Module from CSL Mobile Limited. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).
Official description
CSL 1010 M2M 3G WiFi Module firmware through 2.2.1.4 contains a weak encryption vulnerability that allows unauthenticated attackers to recover all stored secrets in plaintext by reversing a single-byte XOR cipher that uses a static key to obfuscate the configuration backup file. Attackers can trivially decrypt the Router.cfg backup file to expose web administration and telnet passwords, WPA/WPA2 pre-shared keys, PPPoE and 3G/APN credentials, and SIM identifiers including IMSI and IMEI.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| CSL Mobile Limited | CSL 1010 M2M 3G WiFi Module | 0 – through 2.2.1.4 |
Weakness: CWE-261 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N