CVE-2026-19900
HighCVSS 8.1Exploitation Probability (EPSS)
High risk77th percentile - higher than 77% of all known CVEs
Summary
A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206 involving hard-coded credentials in the /etc/shadow file. The attack can be initiated remotely but requires high complexity and is difficult to exploit. The exploit is publicly available.
Risk Assessment
The risk involves potential remote access to the device using hard-coded credentials, which could lead to unauthorized access and control of the device.
Recommendation
It is recommended to immediately change default credentials and contact the vendor for a patch or firmware update.
Original NVD description (English source)
A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206. The impacted element is an unknown function of the file /etc/shadow. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. A high degree of complexity is needed for the attack. The exploitability is regarded as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.