CVE-2026-19412: CWE-798: Use of Hard-coded Credentials in CP Plus CP-XR-DE21-S Router

CVE-2026-19412 is a vulnerability in the CP Plus CP-XR-DE21-S Router caused by the presence of hardcoded HTTP Digest authentication credentials embedded in the firmware. These credentials are the same for all devices running the affected firmware, enabling an attacker on the local network to extract these credentials and gain unauthorized administrative access. The vulnerability is classified under CWE-798 (Use of Hard-coded Credentials). No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker with local network access to bypass authentication and obtain administrative privileges on the affected router. This can lead to unauthorized configuration changes, potential network disruption, and compromise of network security. The CVSS 4.0 base score is 8.7, indicating a high severity impact with low attack complexity and no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local network access to trusted users only and monitor for unauthorized access attempts. Consider network segmentation to limit exposure of the affected device.