CP-XR-DE21-S Router CVE-2026-19412

The attacker must be adjacent to the target device - on the same LAN segment, VLAN, or broadcast domain - to reach the HTTP management interface; AV:A in the CVSS 4.0 vector confirms this requirement and excludes remote internet-based exploitation. No authentication beyond possession of the hardcoded credential is required (PR:N), and no special device configuration, optional feature, or non-default setting is needed - the hardcoded credential is present in firmware by default on all affected units. Exploitation is bounded by network adjacency: network segmentation, management VLAN isolation, or ACLs blocking the management port prevent an attacker from reaching the vulnerable interface even if they possess the extracted credentials.

The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) scores 8.7 and accurately reflects the exploit posture: adjacent-network positioning is the only barrier, complexity is low, no authentication is required, and the compromise yields full confidentiality, integrity, and availability impact on the router. EPSS data was not available in the source intelligence, so probabilistic exploitation forecasting cannot be performed. CISA KEV does not list this CVE and no public proof-of-concept has been identified, meaning active exploitation is unconfirmed at time of analysis. Despite the absence of confirmed in-the-wild use, the mechanics are trivially reproducible - firmware images for consumer routers are frequently hosted publicly, and credential extraction from binaries is a well-understood technique requiring no specialist tooling. The wildcard CPE version scope is a significant concern: CP Plus has not communicated a safe firmware version, suggesting the fix either does not yet exist or has not been publicly bounded. Networks relying on this router for perimeter or segmentation functions face elevated risk given the total administrative compromise an attacker achieves.

An attacker already positioned on the local network segment - through a compromised host, rogue wireless association, or physical network access - downloads the CP-XR-DE21-S firmware image from a public source and uses standard binary analysis tooling to locate and extract the hardcoded HTTP Digest credential. The attacker then issues an authenticated HTTP request to the router management interface using the extracted credential, immediately gaining full administrative privileges. No public proof-of-concept has been identified, but the technique requires no specialist knowledge beyond basic firmware analysis.