{"id":"CVE-2026-19412","state":"PUBLISHED","title":"Hardcoded Credentials Vulnerability in CP Plus CP-XR-DE21-S Router","description":"This vulnerability exists in the CP Plus CP-XR-DE21-S Router due to the presence of hardcoded HTTP Digest authentication credentials in the firmware that are identical across all devices running the affected firmware. An attacker with access to the local network could exploit this vulnerability by obtaining the hardcoded authentication information from the firmware.\n\n \n\nSuccessful exploitation of this vulnerability could allow the attacker to gain unauthorized administrative access and perform privileged operations on the targeted device.","publishedAt":"2026-08-28T13:39:47.514Z","updatedAt":"2026-08-28T18:24:37.115Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"CERT-In"},"assigner":"CERT-In","products":["CP Plus CP-XR-DE21-S Router"],"affected":[{"vendor":"CP Plus","product":"CP-XR-DE21-S Router","defaultStatus":"unaffected","versions":[{"version":"version 1.057.043_0027 or below","status":"affected"}]}],"references":["https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0428"],"weaknesses":["CWE-798"],"ingestedAt":"2026-10-29T20:11:10.572Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/19xxx/CVE-2026-19412.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-19412","state":"PUBLISHED","datePublished":"2026-08-28T13:39:47.514Z","dateUpdated":"2026-08-28T18:24:37.115Z","assignerShortName":"CERT-In","assignerOrgId":"66834db9-ab24-42b4-be80-296b2e40335c","dateReserved":"2026-08-10T09:43:00.341Z"},"containers":{"cna":{"title":"Hardcoded Credentials Vulnerability in CP Plus CP-XR-DE21-S Router","descriptions":[{"lang":"en","value":"This vulnerability exists in the CP Plus CP-XR-DE21-S Router due to the presence of hardcoded HTTP Digest authentication credentials in the firmware that are identical across all devices running the affected firmware. An attacker with access to the local network could exploit this vulnerability by obtaining the hardcoded authentication information from the firmware.\n\n \n\nSuccessful exploitation of this vulnerability could allow the attacker to gain unauthorized administrative access and perform privileged operations on the targeted device."}],"affected":[{"vendor":"CP Plus","product":"CP-XR-DE21-S Router","defaultStatus":"unaffected","versions":[{"version":"version 1.057.043_0027 or below","status":"affected"}]}],"references":[{"url":"https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0428","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"HIGH","baseScore":8.7,"vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-798","lang":"en","description":"CWE-798: Use of Hard-coded Credentials","type":"CWE"}]}],"providerMetadata":{"shortName":"CERT-In","orgId":"66834db9-ab24-42b4-be80-296b2e40335c","dateUpdated":"2026-08-28T13:39:47.514Z"},"impacts":[{"capecId":"CAPEC-191","descriptions":[{"lang":"en","value":"CAPEC-191 Read Sensitive Constants Within an Executable"}]}],"cpeApplicability":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:cp_plus:cp-xr-de21-s_router:version_1.057.043_0027_or_below:*:*:*:*:*:*:*"}]}]}],"solutions":[{"lang":"en","value":"Upgrade CP Plus CP-XR-DE21-S Router to patched firmware version 1.057.043_0034\n\nhttps://cpplusworld.com/prodassets/firmware/02a50613-6182-41dc-8b7f-cd58f1e6cba5.bin","supportingMedia":[{"type":"text/html","base64":false,"value":"Upgrade CP Plus CP-XR-DE21-S Router to patched firmware version 1.057.043_0034\n<br>https://cpplusworld.com/prodassets/firmware/02a50613-6182-41dc-8b7f-cd58f1e6cba5.bin&nbsp;<br>"}]}],"credits":[{"lang":"en","value":"This vulnerability is reported by a team of security researchers including Stalin S, Harini M, Rohit Surya A T and Reginald Alfret V.","type":"finder"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.5"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-28T18:24:12.432681Z","id":"CVE-2026-19412","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-28T18:24:37.115Z"}}]}}}