CVE-2026-19971
Received Received - Intake

Authentication Bypass in LB-Link WR1210M Router

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulDB

Description
A flaw has been found in LB-Link WR1210M 1.0.3. This impacts the function main of the file /www/cgi-bin/backup.cgi of the component Backup Endpoint. This manipulation causes missing authentication. The attack is only possible within the local network. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-19971
EUVD
EUVD-2026-60022

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
lb-link wr1210m 1.0.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a missing authentication flaw in the LB-Link WR1210M 1.0.3 router. It exists in the backup.cgi file of the Backup Endpoint component. An attacker within the local network can exploit this to perform unauthorized actions without authentication.

Detection Guidance

This vulnerability is specific to LB-Link WR1210M version 1.0.3 and involves missing authentication in the backup endpoint. To detect it, check if the device is running the vulnerable firmware version. Access the device's admin panel and verify the firmware version in system settings. Alternatively, scan the local network for the device and inspect its web interface or configuration files for the backup endpoint path /www/cgi-bin/backup.cgi.

Impact Analysis

An attacker on the same local network could access sensitive router functions, such as backing up or restoring configurations, without authentication. This may lead to unauthorized changes, data exposure, or network compromise.

Compliance Impact

This flaw could violate compliance requirements that mandate strict access controls and authentication for network devices handling sensitive data. Unauthorized access risks data breaches, potentially leading to GDPR fines or HIPAA violations.

Mitigation Strategies

Since the vendor did not respond, the best mitigation is to isolate the device from the local network or disable remote access to the backup endpoint. Update the firmware if a patch becomes available. If the device is not essential, consider replacing it with a supported model. Monitor network traffic for unauthorized access attempts to the backup endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19971. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart