This vulnerability involves hard-coded credentials embedded in an unknown function within the /etc/config/easycwmp file of LB-LINK X-PRO firmware version 1.0.22-20231206. The presence of hard-coded credentials can allow remote attackers to gain unauthorized access to the device. The attack requires high complexity and no user interaction, but the exploit has been publicly disclosed. The vendor has not issued any fix or advisory, and no patch information is available.

Successful exploitation of this vulnerability can lead to unauthorized remote access to the affected device due to hard-coded credentials. This could compromise device confidentiality and integrity. Given the critical CVSS score of 9.2, the impact is severe. However, the attack complexity is high, which may limit widespread exploitation. There are no known exploits in the wild at this time.

No official patch or remediation is currently available from the vendor. Since the vendor did not respond to the disclosure, users should consider mitigating risk by isolating affected devices from untrusted networks or replacing them with devices from vendors that provide timely security updates. Monitor vendor channels for any future advisories or patches.