CVE-2026-67596

CSL 1010 M2M 3G WiFi Module firmware through 2.2.1.4 contains a weak encryption vulnerability that allows unauthenticated attackers to recover all stored secrets in plaintext by reversing a single-byte XOR cipher that uses a static key to obfuscate the configuration backup file. Attackers can trivially decrypt the Router.cfg backup file to expose web administration and telnet passwords, WPA/WPA2 pre-shared keys, PPPoE and 3G/APN credentials, and SIM identifiers including IMSI and IMEI.

CVSS v3 6.2 MEDIUM

6.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.5 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://1010.com.hk/
https://www.vulncheck.com/advisories/csl-1010-m2m-3g-wifi-module-weak-encryption-via-router-cfg
https://www.zeroscience.mk/#/advisories/ZSL-2026-6000

Configurations

No configuration.

History

23 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) El firmware del módulo WiFi 3G M2M CSL 1010 hasta la versión 2.2.1.4 contiene una vulnerabilidad de cifrado débil que permite a atacantes no autenticados recuperar todos los secretos almacenados en texto plano invirtiendo un cifrado XOR de un solo byte con una clave estática aplicado al archivo de copia de seguridad de configuración. Los atacantes pueden descifrar trivialmente el archivo de copia de seguridad Router.cfg para exponer contraseñas de administración web y telnet, claves precompartidas WPA/WPA2, credenciales PPPoE y 3G/APN, e identificadores de SIM, incluyendo IMSI e IMEI.

Information

Published : 2026-07-30 16:17

Updated : 2026-10-23 22:10

NVD link : CVE-2026-67596

Mitre link : CVE-2026-67596

CVE.ORG link : CVE-2026-67596

JSON object : View

Products Affected

No product.

CWE

CWE-261

Weak Encoding for Password

{"id": "CVE-2026-67596", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-67596", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-30T17:28:00.802110Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.5}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "CSL Mobile Limited", "product": "CSL 1010 M2M 3G WiFi Module", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2.2.1.4"}], "defaultStatus": "affected"}]}], "published": "2026-07-30T16:17:16.497", "references": [{"url": "https://1010.com.hk/", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/csl-1010-m2m-3g-wifi-module-weak-encryption-via-router-cfg", "source": "disclosure@vulncheck.com"}, {"url": "https://www.zeroscience.mk/#/advisories/ZSL-2026-6000", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-261"}]}], "descriptions": [{"lang": "en", "value": "CSL 1010 M2M 3G WiFi Module firmware through 2.2.1.4 contains a weak encryption vulnerability that allows unauthenticated attackers to recover all stored secrets in plaintext by reversing a single-byte XOR cipher that uses a static key to obfuscate the configuration backup file. Attackers can trivially decrypt the Router.cfg backup file to expose web administration and telnet passwords, WPA/WPA2 pre-shared keys, PPPoE and 3G/APN credentials, and SIM identifiers including IMSI and IMEI."}, {"lang": "es", "value": "El firmware del m\u00f3dulo WiFi 3G M2M CSL 1010 hasta la versi\u00f3n 2.2.1.4 contiene una vulnerabilidad de cifrado d\u00e9bil que permite a atacantes no autenticados recuperar todos los secretos almacenados en texto plano invirtiendo un cifrado XOR de un solo byte con una clave est\u00e1tica aplicado al archivo de copia de seguridad de configuraci\u00f3n. Los atacantes pueden descifrar trivialmente el archivo de copia de seguridad Router.cfg para exponer contrase\u00f1as de administraci\u00f3n web y telnet, claves precompartidas WPA/WPA2, credenciales PPPoE y 3G/APN, e identificadores de SIM, incluyendo IMSI e IMEI."}], "lastModified": "2026-10-23T22:10:00.160", "sourceIdentifier": "disclosure@vulncheck.com"}