CVE-2026-19412 — Hardcoded Credentials Vulnerability in CP Plus CP-XR-DE21-S Router

Description (CNA)

This vulnerability exists in the CP Plus CP-XR-DE21-S Router due to the presence of hardcoded HTTP Digest authentication credentials in the firmware that are identical across all devices running the affected firmware. An attacker with access to the local network could exploit this vulnerability by obtaining the hardcoded authentication information from the firmware. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized administrative access and perform privileged operations on the targeted device.

Affected (CNA)

Vendor / product	Versions
CP Plus / CP-XR-DE21-S Router	affected version 1.057.043_0027 or below

CWE

CWE-798

References

https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0428

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.