CVE-2026-67596CWE-261

CVE-2026-67596

Medium · published July 30, 2026

CVSS v3.1
6.2
EPSS
0%
Percentile
1.3
In the wild
Unconfirmed
What it is

CSL 1010 M2M 3G WiFi Module firmware through 2.2.1.4 contains a weak encryption vulnerability that allows unauthenticated attackers to recover all stored secrets in plaintext by reversing a single-byte XOR cipher that uses a static key to obfuscate the configuration backup file. Attackers can trivially decrypt the Router.cfg backup file to expose web administration and telnet passwords, WPA/WPA2 pre-shared keys, PPPoE and 3G/APN credentials, and SIM identifiers including IMSI and IMEI.

The record
Technical detail
CVSS v3.1
6.2 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00108 · 1.3th percentile
Weakness
CWE-261 · Weak Encoding for Password
Published
2026-07-30T20:17Z
References (3)
https://1010.com.hk/ · [email protected]https://www.vulncheck.com/advisories/csl-1010-m2m-3g-wifi-module-weak-encryption-via-router-cfg · [email protected]https://www.zeroscience.mk/#/advisories/ZSL-2026-6000 · [email protected]
EPSS history
Timeline
  • 30 JUL 14:59Z
    CSL 1010 M2M 3G WiFi Module 2.2.1.4 Weak Encryption via Router.cfg
    cvelistv5