CSL 1010 M2M CVE-2026-67596

Exploitation requires that the attacker obtain the Router.cfg configuration backup file from the device, which necessitates local (physical) access to the device per the CVSS 4.0 AV:L designation. No authentication or privileges are required once the file is obtained - the XOR decryption is a purely offline operation. The primary limiting factor is physical access: the device must be reachable in person (or via out-of-band management if the backup file is accessible through a secondary interface). All firmware versions through 2.2.1.4 are affected regardless of specific configuration. There are no additional protocol, feature enablement, or non-default configuration prerequisites - any deployment of the affected firmware with the default backup mechanism is vulnerable to credential extraction upon physical access.

The CVSS 4.0 base score of 6.9 reflects AV:L (local access vector), AC:L (trivial exploitation), PR:N (no privileges required), and VC:H (high confidentiality impact on the vulnerable system), with no integrity or availability impact and no scope change to subsequent systems. The AV:L constraint is the primary limiting factor - an attacker must achieve some form of local access to the device to obtain Router.cfg, which meaningfully narrows the attack surface compared to a network-accessible vulnerability. However, given the device is a 3G/M2M gateway often deployed in remote or unattended physical locations, physical access controls may be weak in practice. No EPSS data was provided, no CISA KEV listing exists, and no POC code has been identified - reducing urgency relative to a network-exploitable disclosure. The real-world risk is highest in scenarios where multiple devices share configuration backup infrastructure or where devices are deployed in physically accessible locations without tamper controls. The breadth of credential types exposed (admin, telnet, wireless, mobile network, SIM) means a single successful extraction yields a full compromise of the device and potentially upstream mobile network sessions. CVSS and description are consistent - no conflicting signals detected.

An attacker with physical access to an unattended CSL 1010 M2M device - common in remote IoT/M2M deployments - extracts the Router.cfg configuration backup from the device storage or via a backup export mechanism. Applying a simple single-byte XOR decryption loop with the static key (derivable by inspection or brute force across 256 possible values) immediately yields all stored credentials in plaintext, including the WPA2 PSK and SIM-linked 3G/APN credentials, enabling the attacker to join the wireless network, authenticate to the web and telnet management interfaces, and potentially impersonate the device on the mobile network.