EUVD-2026-59777
GHSA-c8h5-32j5-pvrj
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable TR-069 service with hard-coded credentials; AC:H retained because credential discovery is nominally required; PR:N as credentials grant access without prior device privileges; no scope change beyond the router.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
2DescriptionCVE.org
A security flaw has been discovered in LB-LINK X-PRO 1.0.22-20231206. This affects an unknown function of the file /etc/config/easycwmp. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is reported as difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Hard-coded TR-069 remote management credentials in LB-LINK X-PRO firmware 1.0.22-20231206 allow network-accessible unauthenticated attackers to authenticate to the device's CWMP interface via static credentials embedded in /etc/config/easycwmp. A public proof-of-concept exploit has been released, effectively eliminating the primary barrier to exploitation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The easycwmp service must be reachable over the network (typically TCP port 7547); the hard-coded credentials are present by design in firmware 1.0.22-20231206 regardless of any user configuration, so no misconfiguration or special setup on the victim's part is required. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 8.2 with AV:N/AC:H/PR:N reflects that exploitation is network-reachable and requires no privileges, but retains high attack complexity because the attacker must know the static credentials. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis - the vendor did not respond to disclosure. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all LB-LINK X-PRO devices to identify those running firmware 1.0.22-20231206 or earlier, and immediately restrict network access to TR-069 CWMP ports (UDP/TCP 7547 and TCP 7548-7549) at firewall perimeter rules, blocking untrusted networks from these devices. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-259 – Use of Hard-coded Password
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today