What’s Vulnerable › Vulnerabilities
CVE-2026-19412: Hardcoded Credentials Vulnerability in CP Plus CP-XR-DE21-S Router
- Severity: high (CVSS 8.7 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-28 · updated 2026-09-01
- Weakness: CWE-798
Description
This vulnerability exists in the CP Plus CP-XR-DE21-S Router due to the presence of hardcoded HTTP Digest authentication credentials in the firmware that are identical across all devices running the affected firmware. An attacker with access to the local network could exploit this vulnerability by obtaining the hardcoded authentication information from the firmware. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized administrative access and perform privileged operations on the targeted device.
Affected products
- CP Plus CP-XR-DE21-S Router: through version 1.057.043_0027
References
Get alerted when CVE-2026-19412 or the next vulnerability affects your stack