CVE-2026-19412 HIGH

CVE-2026-19412: Hardcoded Credentials Vulnerability in CP Plus CP-XR-DE21-S Router

Vendor Cp Plus
Product CP-XR-DE21-S Router
Weakness CWE-798 · Hardcoded credentials
Published August 28, 2026
Last update August 28, 2026

CVSS base score

8.7/10
Attack vector Adjacent
Attack complexity Low
Privileges required None
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

This vulnerability exists in the CP Plus CP-XR-DE21-S Router due to the presence of hardcoded HTTP Digest authentication credentials in the firmware that are identical across all devices running the affected firmware. An attacker with access to the local network could exploit this vulnerability by obtaining the hardcoded authentication information from the firmware. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized administrative access and perform privileged operations on the targeted device.

Key dates

02Disclosure timeline

August 28, 2026 CVE published
August 28, 2026 Record updated

Related vulnerabilities

04Related CVE