LB-Link WR1210M EUVD-2026-60022

Q: What is the CVSS score of EUVD-2026-60022?

EUVD-2026-60022 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-19971 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-08-17 VulDB

GHSA-68gf-2fwf-ggrm

Authentication Bypass Wr1210M Lb Link

5.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Adjacent-network access required (AV:A), no authentication or interaction needed (PR:N/UI:N), impact limited to partial confidentiality of backup data (C:L) with no integrity or availability consequence.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 02:13 vuln.today

DescriptionCVE.org

A flaw has been found in LB-Link WR1210M 1.0.3. This impacts the function main of the file /www/cgi-bin/backup.cgi of the component Backup Endpoint. This manipulation causes missing authentication. The attack is only possible within the local network. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

The backup endpoint on LB-Link WR1210M firmware 1.0.3 exposes device configuration data to unauthenticated adjacent-network attackers due to missing authentication in the main() function of /www/cgi-bin/backup.cgi. Any attacker on the same local network segment can retrieve the router's backup archive without credentials, potentially obtaining Wi-Fi passphrases, administrative passwords, and network configuration. No public exploit has been identified at time of analysis, and the vendor did not respond to responsible disclosure, leaving no patch available.

Technical ContextAI

The LB-Link WR1210M is a consumer wireless router running an embedded web server that exposes CGI scripts for device management. The vulnerable component is the backup.cgi script (CPE: cpe:2.3:a:lb-link:wr1210m:*:*:*:*:*:*:*:*), which handles configuration backup export via the main() function. CWE-306 (Missing Authentication for Critical Function) identifies the root cause: the endpoint performs a sensitive, data-exfiltrating operation - exporting a full device configuration archive - without verifying the identity or authorization of the requester. Router backup archives in this class of device commonly contain cleartext or weakly-encoded credentials including administrative passwords and wireless pre-shared keys. The wildcard CPE version field indicates all firmware versions may be affected, though only 1.0.3 was explicitly tested.

RemediationAI

No vendor-released patch has been identified at time of analysis; the vendor did not respond to responsible disclosure. As compensating controls, administrators should restrict access to the router's web management interface by binding it to a dedicated management VLAN accessible only to trusted administrator hosts - this prevents arbitrary LAN clients from reaching backup.cgi, though it requires VLAN-capable switching infrastructure. If the firmware supports access control lists on the management interface, explicitly deny access to /cgi-bin/backup.cgi from non-administrative source IPs. Organizations with high-sensitivity requirements should consider replacing the LB-Link WR1210M with a supported device from a vendor with an active security response program. Monitor VulDB at https://vuldb.com/vuln/391148 for any future patch releases.