Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.7

CP Plus CP-XR-DE21-S Router lets anyone log in as admin

CVE-2026-19412 · published 2 months ago
Summary

The CP Plus CP-XR-DE21-S router contains a set of built‑in login details that are the same on every unit. Anyone on the same local network can read these credentials from the device’s software and then gain full administrative control. Replace the firmware with an updated version or change the default passwords as soon as possible to block unauthorized access.

Original advisory text
This vulnerability exists in the CP Plus CP-XR-DE21-S Router due to the presence of hardcoded HTTP Digest authentication credentials in the firmware that are identical across all devices running th...
This vulnerability exists in the CP Plus CP-XR-DE21-S Router due to the presence of hardcoded HTTP Digest authentication credentials in the firmware that are identical across all devices running the affected firmware. An attacker with access to the local network could exploit this vulnerability by obtaining the hardcoded authentication information from the firmware.



Successful exploitation of this vulnerability could allow the attacker to gain unauthorized administrative access and perform privileged operations on the targeted device.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.7 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-798Use of Hard-coded Credentials
Timeline
Published28 Aug 2026
Updated4 Nov 2026
First seen28 Aug 2026
Sources
CVE-2026-19412 · NVD
Track software like this
Free during beta