EUVD-2026-51157
GHSA-fvx5-jmmg-89rf
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:L because obtaining Router.cfg requires local device access; PR:N as offline decryption needs no credentials; C:H for full plaintext credential disclosure; no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
CSL 1010 M2M 3G WiFi Module firmware through 2.2.1.4 contains a weak encryption vulnerability that allows unauthenticated attackers to recover all stored secrets in plaintext by reversing a single-byte XOR cipher with a static key applied to the configuration backup file. Attackers can trivially decrypt the Router.cfg backup file to expose web administration and telnet passwords, WPA/WPA2 pre-shared keys, PPPoE and 3G/APN credentials, and SIM identifiers including IMSI and IMEI.
AnalysisAI
Credential exposure in CSL 1010 M2M 3G WiFi Module firmware through 2.2.1.4 stems from a trivially reversible single-byte XOR cipher with a hard-coded static key used to 'protect' the Router.cfg configuration backup file. An attacker with local access to the device can decrypt the backup and recover web administration passwords, telnet credentials, WPA/WPA2 pre-shared keys, PPPoE and 3G/APN credentials, and SIM identifiers (IMSI and IMEI) in plaintext. No public exploit has been identified at time of analysis, KEV listing is absent, and no fixed firmware version has been confirmed.
Technical ContextAI
The affected product is CSL Mobile Limited's CSL 1010 M2M 3G WiFi Module, a carrier-branded IoT/M2M gateway device (CPE: cpe:2.3:a:csl_mobile_limited:csl_1010_m2m_3g_wifi_module:*:*:*:*:*:*:*:*). The vulnerability maps to CWE-261 (Weak Encoding for Password), which describes the class of flaws where secrets are encoded rather than cryptographically protected. A single-byte XOR cipher with a static (hard-coded) key provides zero effective confidentiality - reversing it requires only knowledge of any one plaintext-ciphertext pair or a known-plaintext segment, and is achievable with trivial scripting. The configuration backup file Router.cfg aggregates all sensitive device secrets, making its compromise a complete credential disclosure event. The device supports 3G/M2M connectivity, meaning downstream SIM-linked mobile network credentials (including IMSI/IMEI) are also at risk beyond the local network perimeter.
RemediationAI
No vendor-released patched firmware version has been identified in the available data at time of analysis. Organizations should contact CSL Mobile Limited via https://1010.com.hk/ to inquire about a firmware update addressing CVE-2026-67596. In the absence of a patch, apply the following compensating controls: restrict physical access to devices using tamper-evident enclosures or locked cabinets, as the attack requires local device access; disable the configuration backup feature if supported and if remote backup is not operationally required (trade-off: loss of disaster recovery capability); rotate all credentials stored on the device - web admin passwords, telnet passwords, WPA/WPA2 PSKs, PPPoE credentials, 3G/APN credentials - and do not reuse them across devices or services; and audit whether Router.cfg backup files are stored on shared or network-accessible storage, removing or restricting access to any existing copies. The VulnCheck advisory (https://www.vulncheck.com/advisories/csl-1010-m2m-3g-wifi-module-weak-encryption-via-router-cfg) and ZeroScience advisory (https://www.zeroscience.mk/#/advisories/ZSL-2026-6000) should be monitored for patch availability updates.
Same weakness CWE-261 – Weak Encoding for Password
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today