Description
A flaw has been found in LB-Link WR1210M 1.0.3. This impacts the function main of the file /www/cgi-bin/backup.cgi of the component Backup Endpoint. This manipulation causes missing authentication. The attack is only possible within the local network. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-08-17
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the main function of /www/cgi-bin/backup.cgi on LB-Link WR1210M firmware 1.0.3. An attacker can manipulate the request to bypass authentication, allowing them to access the backup interface without credentials. This provides the potential to download or modify configuration backups, exposing sensitive network information.

Affected Systems

This flaw affects the LB-Link WR1210M model running firmware version 1.0.3. No other product or version information is documented.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate level of risk. While the EPSS score is not available, the vulnerability is also not listed in the KEV catalog. The likely attack vector is a local network attacker able to send crafted requests to the device, so compromise is limited to hosts within the same LAN segment. No public exploit has been found, but the absence of an authentication check means that any local user can exploit it.

Generated by OpenCVE AI on August 17, 2026 at 03:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Block traffic to /www/cgi-bin/backup.cgi using firewall or router ACLs
  • Remove or isolate the affected device from the local network until a firmware update is available
  • Monitor network traffic for suspicious requests to backup.cgi and keep the device firmware updated when patches are released

Generated by OpenCVE AI on August 17, 2026 at 03:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 17 Aug 2026 02:00:00 +0000

Type Values Removed Values Added
Description A flaw has been found in LB-Link WR1210M 1.0.3. This impacts the function main of the file /www/cgi-bin/backup.cgi of the component Backup Endpoint. This manipulation causes missing authentication. The attack is only possible within the local network. The vendor was contacted early about this disclosure but did not respond in any way.
Title LB-Link WR1210M Backup Endpoint backup.cgi main missing authentication
First Time appeared Lb-link
Lb-link wr1210m
Weaknesses CWE-287
CWE-306
CPEs cpe:2.3:a:lb-link:wr1210m:*:*:*:*:*:*:*:*
Vendors & Products Lb-link
Lb-link wr1210m
References
Metrics cvssV2_0

{'score': 3.3, 'vector': 'AV:A/AC:L/Au:N/C:P/I:N/A:N/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.7, 'vector': 'CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X'}

Subscriptions

Lb-link Wr1210m
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-17T01:30:08.358Z

Reserved: 2026-08-16T07:58:08.640Z

Link: CVE-2026-19971

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-17T02:16:41.203

Modified: 2026-08-17T02:16:41.203

Link: CVE-2026-19971

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-17T03:30:12Z

Weaknesses
  • CWE-287

    Improper Authentication

  • CWE-306

    Missing Authentication for Critical Function