# CVE-2026-19412: CP Plus CP-XR-DE21-S hardcoded authentication credentials

Source: https://junglewise.ai/threats/cve-2026-19412-cp-plus-cp-xr-de21-s-hardcoded-authentication-credentials  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-19412 · Severity: info · Published 2026-08-28

The CP Plus CP-XR-DE21-S is a 4G LTE router used for home and small-office internet connectivity. This device contains hardcoded HTTP Digest authentication credentials in its firmware that are identical across all affected devices. An attacker on the same local network can extract these credentials from the firmware and gain full administrative access to the router, allowing them to modify network settings, intercept traffic, or lock legitimate users out of their device.

Vendors: [CP Plus](https://junglewise.ai/threats/vendors/cp-plus).

## Quick answers

**Is CVE-2026-19412 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19412 being exploited in the wild.

**How severe is CVE-2026-19412?** Informational severity, published 28 August 2026.

**Which products and versions are affected?** CP Plus CP-XR-DE21-S firmware version 1.057.043_0027 and earlier.

**Is there a fix for CVE-2026-19412?** A patch was published on 2026-08-28: Patched firmware version 1.057.043_0034 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-19412 attacked?** It is attacked from the adjacent network.

**Am I affected by CVE-2026-19412?** Check whether you run CP Plus CP-XR-DE21-S at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a hardcoded credentials weakness in the HTTP Digest authentication mechanism of the CP Plus CP-XR-DE21-S router firmware. The root cause is the embedding of identical authentication credentials in the firmware image deployed across all devices, making them discoverable through firmware extraction and analysis. Attack vector is adjacent network (local network access required); no authentication bypass is needed since the credentials are exposed in plaintext or easily reversible form in the firmware. Successful exploitation grants an attacker administrative access to perform privileged operations on the targeted device. A patch is available: firmware version 1.057.043_0034 or later resolves this issue.

## Affected products

- CP Plus CP-XR-DE21-S firmware version 1.057.043_0027 and earlier

## Timeline

- 2026-08-28: disclosed
- 2026-08-28: patched: Patched firmware version 1.057.043_0034 released

## References

- [https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0428](https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0428)