CVE-2026-19901

Received Received - Intake

Hard-Coded Credentials in LB-LINK X-PRO Firmware

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: VulDB

Description

A security flaw has been discovered in LB-LINK X-PRO 1.0.22-20231206. This affects an unknown function of the file /etc/config/easycwmp. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is reported as difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-15

Generated

2026-08-16

AI Q&A

2026-08-16

EPSS Evaluated

N/A

NVD

CVE-2026-19901

EUVD

EUVD-2026-59777

Affected Vendors & Products

Vendor	Product	Version / Range
lb-link	x-pro	1.0.22-20231206

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-259	The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.
CWE-798	The product contains hard-coded credentials, such as a password or cryptographic key.

Attack-Flow Graph

Executive Summary

This vulnerability is a security flaw in LB-LINK X-PRO version 1.0.22-20231206 that involves hard-coded credentials in the file /etc/config/easycwmp. The issue allows remote attackers to gain unauthorized access due to the presence of these credentials.

Impact Analysis

An attacker could exploit this vulnerability to remotely access the device, potentially leading to unauthorized control, data theft, or further network compromise. The exploit is publicly available and requires a complex attack, but the impact could be severe if successful.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. Organizations using this device may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately check if LB-LINK X-PRO devices are present on your network. Verify if the firmware version is 1.0.22-20231206 or affected. Disable remote access to the device if possible. Change default credentials if hard-coded credentials are confirmed. Contact the vendor for patches or updates.

Hi! I’m here to help you understand CVE-2026-19901. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70