Cp Xr De21 S Router
Monthly
Hardcoded HTTP Digest authentication credentials baked into CP Plus CP-XR-DE21-S Router firmware grant any adjacent-network attacker full administrative access without valid credentials. Because the credentials are identical across every device running the affected firmware, a single firmware extraction exposes the entire deployed population. No active exploitation is confirmed by CISA KEV, but the trivially low exploitation complexity and total administrative compromise make this a high-priority remediation target for any network where this router is deployed.
Hardcoded HTTP Digest authentication credentials baked into CP Plus CP-XR-DE21-S Router firmware grant any adjacent-network attacker full administrative access without valid credentials. Because the credentials are identical across every device running the affected firmware, a single firmware extraction exposes the entire deployed population. No active exploitation is confirmed by CISA KEV, but the trivially low exploitation complexity and total administrative compromise make this a high-priority remediation target for any network where this router is deployed.