Log in Start free

Vulnerability · Published Aug 15, 2026 · Assigned by VulDB

CVE-2026-19901LB-LINK X-PRO easycwmp hard-coded credentials

High 8.1

In plain English

A high-severity hard-coded credentials in X-PRO from LB-LINK. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.8%top 44.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in LB-LINK X-PRO 1.0.22-20231206. This affects an unknown function of the file /etc/config/easycwmp. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is reported as difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

VendorProductVersions
LB-LINK X-PRO 1.0.22-20231206

Weakness: CWE-798, CWE-259 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R

References