EUVD-2026-67719
GHSA-3h26-q4ch-cw3m
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent network access is the sole barrier; hardcoded credentials require no privileges; full CIA impact confined to the router with no scope change.
Primary rating from Vendor (CERT-In).
CVSS VectorVendor: CERT-In
Lifecycle Timeline
2DescriptionCVE.org
This vulnerability exists in the CP Plus CP-XR-DE21-S Router due to the presence of hardcoded HTTP Digest authentication credentials in the firmware that are identical across all devices running the affected firmware. An attacker with access to the local network could exploit this vulnerability by obtaining the hardcoded authentication information from the firmware.
Successful exploitation of this vulnerability could allow the attacker to gain unauthorized administrative access and perform privileged operations on the targeted device.
AnalysisAI
Hardcoded HTTP Digest authentication credentials baked into CP Plus CP-XR-DE21-S Router firmware grant any adjacent-network attacker full administrative access without valid credentials. Because the credentials are identical across every device running the affected firmware, a single firmware extraction exposes the entire deployed population. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be adjacent to the target device - on the same LAN segment, VLAN, or broadcast domain - to reach the HTTP management interface; AV:A in the CVSS 4.0 vector confirms this requirement and excludes remote internet-based exploitation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) scores 8.7 and accurately reflects the exploit posture: adjacent-network positioning is the only barrier, complexity is low, no authentication is required, and the compromise yields full confidentiality, integrity, and availability impact on the router. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No specific patched firmware version is identified in available data - patch status should be verified directly with CP Plus and via CERT-In advisory CIVN-2026-0428 at https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0428. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all CP Plus CP-XR-DE21-S routers in your network, confirm affected firmware versions, and document network locations and administrative dependencies. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-798 – Use of Hard-coded Credentials
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today