CVE-2026-19900CWE-259CWE-798hardcoded-credentials

CVE-2026-19900

High · published August 15, 2026

CVSS v3.1
8.1
EPSS
3%
Percentile
87.0
In the wild
Unconfirmed
What it is

A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206. The impacted element is an unknown function of the file /etc/shadow. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. A high degree of complexity is needed for the attack. The exploitability is regarded as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.2 · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
EPSS
0.02941 · 87.0th percentile
Weaknesses
CWE-259 · Use of Hard-coded Password; CWE-798 · Use of Hard-coded Credentials
Published
2026-08-15T21:16Z
References (5)
https://github.com/DavCloudz/cve/blob/main/B-Link/B-Link%20AC1200%20X-PRO(AC6)%20Hardcoded%20Credentials%20Vulnerability.md · [email protected]https://vuldb.com/cve/CVE-2026-19900 · [email protected]https://vuldb.com/submit/870712 · [email protected]https://vuldb.com/vuln/390090 · [email protected]https://vuldb.com/vuln/390090/cti · [email protected]
EPSS history
Timeline
  • 15 AUG 16:45Z
    LB-LINK X-PRO shadow hard-coded credentials
    cvelistv5