CVE-2026-19412

CVE-2026-19412 is a use of hard-coded credentials (CWE-798) in the CP Plus CP-XR-DE21-S Router: the HTTP Digest authentication credentials embedded in the firmware are identical across all devices running the affected firmware. An attacker who can reach the router's administrative interface from the local (adjacent) network can extract the hardcoded credentials from the firmware and answer the Digest authentication challenge without knowing any user-configured password. Successful exploitation grants unauthorized administrative access, allowing privileged operations on the device. All CP-XR-DE21-S units running the affected firmware are affected, since the shared credentials are a property of the firmware image rather than of any individual deployment. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; EPSS currently estimates only a 0.2% chance of exploitation within 30 days.

What to do: Because the credentials are baked into the firmware, changing the admin password may not eliminate the risk; check with CP Plus/Aditya Infotech (and the CERT-In advisory) for a firmware update that removes or randomizes the hardcoded Digest credentials and apply it when released. Until patched, limit local network access to the router's management interface to trusted devices, keep the admin interface off WAN-facing exposure, and segment guest or IoT devices away from the router's management plane.