This vulnerability is caused by hardcoded HTTP Digest authentication credentials embedded in the firmware of the CP Plus CP-XR-DE21-S Router. Because the same credentials are used on every device with the affected firmware, an attacker who can reach the router from the local network can extract them and gain administrative privileges. The flaw allows the attacker to perform any privileged operation on the device, thereby compromising confidentiality, integrity and availability of network functions managed by the router.

Affected devices are CP Plus CP-XR-DE21-S Routers running firmware versions 1.057.043_0027 or earlier. The vendor lists the affected CPE as cpe:2.3:a:cp_plus:cp-xr-de21-s_router:version_1.057.043_0027_or_below. Updating to firmware 1.057.043_0034 eliminates the hardcoded credentials.

The CVSS score of 8.7 reflects a high severity for this flaw. EPSS information is not available, and the vulnerability does not appear in the CISA KEV catalog. The attack is likely local: an attacker must have access to the local network to read the firmware or tokens and standard HTTP Digest parsing to retrieve the credentials. Once the attacker has the credentials, they can log in as administrator and control the router.