This vulnerability involves hard-coded credentials embedded in an unknown function within the /etc/config/easycwmp file of LB-LINK X-PRO version 1.0.22-20231206. The presence of these fixed credentials enables remote attackers to gain unauthorized access without needing privileges or user interaction. The attack complexity is high, indicating exploitation is difficult but feasible. Although the vendor was notified early, there has been no response or patch released. Public exploit code is available, which may facilitate attacks against affected devices.

Successful exploitation allows remote attackers to authenticate using hard-coded credentials, potentially leading to unauthorized access to the device. Given the critical CVSS score of 9.2 and the lack of vendor response, affected devices remain at high risk. The vulnerability could compromise device confidentiality, integrity, and availability depending on attacker actions post-access.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded and no fixes are published, users should consider mitigating risk by isolating affected devices from untrusted networks and monitoring for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.