CVE-2026-19901CWE-259CWE-798hardcoded-credentials

CVE-2026-19901

High · published August 15, 2026

CVSS v3.1

8.1

EPSS

Percentile

55.0

In the wild

Unconfirmed

What it is

A security flaw has been discovered in LB-LINK X-PRO 1.0.22-20231206. This affects an unknown function of the file /etc/config/easycwmp. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is reported as difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

The record

Technical detail

CVSS v3.1: 8.1 · HIGH
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: 9.2 · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
EPSS: 0.00765 · 55.0th percentile
Weaknesses: CWE-259 · Use of Hard-coded Password; CWE-798 · Use of Hard-coded Credentials
Published: 2026-08-15T22:16Z

References (5)

https://github.com/DavCloudz/cve/blob/main/B-Link/Hardcoded%20TR-069%20(easycwmp)%20Remote%20Management%20Credentials.md · [email protected]https://vuldb.com/cve/CVE-2026-19901 · [email protected]https://vuldb.com/submit/870763 · [email protected]https://vuldb.com/vuln/390091 · [email protected]https://vuldb.com/vuln/390091/cti · [email protected]

EPSS history

Timeline

15 AUG 17:15Z
LB-LINK X-PRO easycwmp hard-coded credentials
cvelistv5