Search
Find a vulnerability
Search criteria
4 vulnerabilities found for X-PRO by LB-LINK
CVE-2026-19901 (GCVE-0-2026-19901)
Vulnerability from nvd – Published: 2026-08-15 17:15 – Updated: 2026-08-15 17:15
VLAI
EPSS
VEX
Title
LB-LINK X-PRO easycwmp hard-coded credentials
Summary
A security flaw has been discovered in LB-LINK X-PRO 1.0.22-20231206. This affects an unknown function of the file /etc/config/easycwmp. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is reported as difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/390091 | vdb-entry |
| https://vuldb.com/vuln/390091/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19901 | third-party-advisory |
| https://vuldb.com/submit/870763 | third-party-advisory |
| https://github.com/DavCloudz/cve/blob/main/B-Link… | exploit |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:lb-link:x-pro:*:*:*:*:*:*:*:*"
],
"product": "X-PRO",
"vendor": "LB-LINK",
"versions": [
{
"status": "affected",
"version": "1.0.22-20231206"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Yun Zhang (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in LB-LINK X-PRO 1.0.22-20231206. This affects an unknown function of the file /etc/config/easycwmp. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is reported as difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.6,
"vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-259",
"description": "Use of Hard-coded Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-15T17:15:07.700Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-390091 | LB-LINK X-PRO easycwmp hard-coded credentials",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/390091"
},
{
"name": "VDB-390091 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/390091/cti"
},
{
"name": "CVE-2026-19901 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19901"
},
{
"name": "Submit #870763 | LB-LINK\uff08\u6df1\u5733\u5fc5\u8054\u7535\u5b50\uff09 B-Link AC1200 X-PRO(AC6)_Dual_V1.0.22-20231206-upgrade.bin Hardcoded Credentials",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/870763"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/DavCloudz/cve/blob/main/B-Link/Hardcoded%20TR-069%20(easycwmp)%20Remote%20Management%20Credentials.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-14T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-14T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-14T21:16:56.000Z",
"value": "VulDB entry last update"
}
],
"title": "LB-LINK X-PRO easycwmp hard-coded credentials",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19901",
"datePublished": "2026-08-15T17:15:07.700Z",
"dateReserved": "2026-08-14T19:11:26.544Z",
"dateUpdated": "2026-08-15T17:15:07.700Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19900 (GCVE-0-2026-19900)
Vulnerability from nvd – Published: 2026-08-15 16:45 – Updated: 2026-08-15 16:45
VLAI
EPSS
VEX
Title
LB-LINK X-PRO shadow hard-coded credentials
Summary
A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206. The impacted element is an unknown function of the file /etc/shadow. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. A high degree of complexity is needed for the attack. The exploitability is regarded as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/390090 | vdb-entry |
| https://vuldb.com/vuln/390090/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19900 | third-party-advisory |
| https://vuldb.com/submit/870712 | third-party-advisory |
| https://github.com/DavCloudz/cve/blob/main/B-Link… | exploit |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:lb-link:x-pro:*:*:*:*:*:*:*:*"
],
"product": "X-PRO",
"vendor": "LB-LINK",
"versions": [
{
"status": "affected",
"version": "1.0.22-20231206"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Yun Zhang (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206. The impacted element is an unknown function of the file /etc/shadow. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. A high degree of complexity is needed for the attack. The exploitability is regarded as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.6,
"vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-259",
"description": "Use of Hard-coded Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-15T16:45:07.432Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-390090 | LB-LINK X-PRO shadow hard-coded credentials",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/390090"
},
{
"name": "VDB-390090 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/390090/cti"
},
{
"name": "CVE-2026-19900 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19900"
},
{
"name": "Submit #870712 | LB-LINK\uff08\u6df1\u5733\u5fc5\u8054\u7535\u5b50\uff09 Router B-Link AC1200 X-PRO(AC6)_Dual_V1.0.22-20231206 Hardcoded Credentials",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/870712"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/DavCloudz/cve/blob/main/B-Link/B-Link%20AC1200%20X-PRO(AC6)%20Hardcoded%20Credentials%20Vulnerability.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-14T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-14T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-14T21:16:52.000Z",
"value": "VulDB entry last update"
}
],
"title": "LB-LINK X-PRO shadow hard-coded credentials",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19900",
"datePublished": "2026-08-15T16:45:07.432Z",
"dateReserved": "2026-08-14T19:11:22.504Z",
"dateUpdated": "2026-08-15T16:45:07.432Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19901 (GCVE-0-2026-19901)
Vulnerability from cvelistv5 – Published: 2026-08-15 17:15 – Updated: 2026-08-15 17:15
VLAI
EPSS
VEX
Title
LB-LINK X-PRO easycwmp hard-coded credentials
Summary
A security flaw has been discovered in LB-LINK X-PRO 1.0.22-20231206. This affects an unknown function of the file /etc/config/easycwmp. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is reported as difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/390091 | vdb-entry |
| https://vuldb.com/vuln/390091/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19901 | third-party-advisory |
| https://vuldb.com/submit/870763 | third-party-advisory |
| https://github.com/DavCloudz/cve/blob/main/B-Link… | exploit |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:lb-link:x-pro:*:*:*:*:*:*:*:*"
],
"product": "X-PRO",
"vendor": "LB-LINK",
"versions": [
{
"status": "affected",
"version": "1.0.22-20231206"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Yun Zhang (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in LB-LINK X-PRO 1.0.22-20231206. This affects an unknown function of the file /etc/config/easycwmp. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is reported as difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.6,
"vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-259",
"description": "Use of Hard-coded Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-15T17:15:07.700Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-390091 | LB-LINK X-PRO easycwmp hard-coded credentials",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/390091"
},
{
"name": "VDB-390091 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/390091/cti"
},
{
"name": "CVE-2026-19901 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19901"
},
{
"name": "Submit #870763 | LB-LINK\uff08\u6df1\u5733\u5fc5\u8054\u7535\u5b50\uff09 B-Link AC1200 X-PRO(AC6)_Dual_V1.0.22-20231206-upgrade.bin Hardcoded Credentials",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/870763"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/DavCloudz/cve/blob/main/B-Link/Hardcoded%20TR-069%20(easycwmp)%20Remote%20Management%20Credentials.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-14T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-14T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-14T21:16:56.000Z",
"value": "VulDB entry last update"
}
],
"title": "LB-LINK X-PRO easycwmp hard-coded credentials",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19901",
"datePublished": "2026-08-15T17:15:07.700Z",
"dateReserved": "2026-08-14T19:11:26.544Z",
"dateUpdated": "2026-08-15T17:15:07.700Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19900 (GCVE-0-2026-19900)
Vulnerability from cvelistv5 – Published: 2026-08-15 16:45 – Updated: 2026-08-15 16:45
VLAI
EPSS
VEX
Title
LB-LINK X-PRO shadow hard-coded credentials
Summary
A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206. The impacted element is an unknown function of the file /etc/shadow. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. A high degree of complexity is needed for the attack. The exploitability is regarded as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/390090 | vdb-entry |
| https://vuldb.com/vuln/390090/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19900 | third-party-advisory |
| https://vuldb.com/submit/870712 | third-party-advisory |
| https://github.com/DavCloudz/cve/blob/main/B-Link… | exploit |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:lb-link:x-pro:*:*:*:*:*:*:*:*"
],
"product": "X-PRO",
"vendor": "LB-LINK",
"versions": [
{
"status": "affected",
"version": "1.0.22-20231206"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Yun Zhang (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206. The impacted element is an unknown function of the file /etc/shadow. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. A high degree of complexity is needed for the attack. The exploitability is regarded as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.6,
"vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-259",
"description": "Use of Hard-coded Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-15T16:45:07.432Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-390090 | LB-LINK X-PRO shadow hard-coded credentials",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/390090"
},
{
"name": "VDB-390090 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/390090/cti"
},
{
"name": "CVE-2026-19900 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19900"
},
{
"name": "Submit #870712 | LB-LINK\uff08\u6df1\u5733\u5fc5\u8054\u7535\u5b50\uff09 Router B-Link AC1200 X-PRO(AC6)_Dual_V1.0.22-20231206 Hardcoded Credentials",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/870712"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/DavCloudz/cve/blob/main/B-Link/B-Link%20AC1200%20X-PRO(AC6)%20Hardcoded%20Credentials%20Vulnerability.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-14T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-14T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-14T21:16:52.000Z",
"value": "VulDB entry last update"
}
],
"title": "LB-LINK X-PRO shadow hard-coded credentials",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19900",
"datePublished": "2026-08-15T16:45:07.432Z",
"dateReserved": "2026-08-14T19:11:22.504Z",
"dateUpdated": "2026-08-15T16:45:07.432Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}