LB-Link WR1210M CVE-2026-19971

Exploitation requires the attacker to be on the same local network segment as the router - adjacency (AV:A) is a hard constraint, meaning internet-sourced attacks are not possible. The attacker must be able to reach the router's web management port (typically TCP 80) from their position on the LAN or wireless network; if the management interface is bound only to a specific interface or VLAN, that further limits the attack surface. No authentication, no special configuration state, and no user interaction are required - the backup.cgi endpoint is exposed by default on firmware 1.0.3. Exploitation is primarily limited by the AV:A constraint: the attacker must have physical LAN access, an already-compromised device on the same segment, or Wi-Fi association (including guest networks if not segmented from the management interface).

The CVSS 4.0 score of 5.3 accurately reflects the constrained threat model: AV:A limits exploitation to adjacent-network attackers only, ruling out internet-based attacks entirely. AC:L and PR:N indicate exploitation is trivial once LAN access is obtained, requiring no special conditions or credentials beyond network adjacency. The impact is bounded to limited confidentiality disclosure (VC:L, SC:L), with no integrity or availability impact. There is no CISA KEV listing and no EPSS data provided, consistent with a low-priority exploitation profile for this obscure device class. However, the vendor's non-response to disclosure is a material risk factor: no patch timeline exists. The primary realistic risk is an insider or rogue Wi-Fi client extracting credentials from the backup file to pivot to other network resources - a credible but targeted threat rather than broad-based exploitation.

An attacker connected to the same Wi-Fi network or LAN segment as the LB-Link WR1210M sends a simple unauthenticated HTTP GET request directly to the router's backup CGI endpoint at http://[router-IP]/cgi-bin/backup.cgi. The endpoint returns the device configuration backup without any authentication challenge, allowing the attacker to download and parse the archive for Wi-Fi credentials, the administrative password, and full network topology data. No public POC has been identified, but the attack requires only a standard HTTP client.