CVE-2026-19971 - Unauthenticated Backup Access in LB-Link WR1210M

CVE-2026-19971 is a missing authentication flaw in the Backup Endpoint component of LB-Link WR1210M router version 1.0.3. The /www/cgi-bin/backup.cgi endpoint does not verify the user's identity, allowing anyone connected to the local network to access the complete device configuration without credentials. Configuration backups contain sensitive data: WiFi passwords, remote access credentials, network parameters, and gateway configuration details.

The vulnerability is rated CVSS 4.7 (medium) because access is restricted to the local network only: an attacker must already be connected to the WiFi or LAN to exploit it. However, the score is significant: exposed configuration enables lateral movement within the internal network or device reconfiguration. The vendor was contacted early but did not respond. A new research signal published on GitHub on 2026-11-01 describes detailed attack chain analysis, including guest network expansion, indicating active research interest.

If your organization uses LB-Link WR1210M 1.0.3 routers, they should be isolated from critical environments or removed from the network. Priority is verifying whether the device is deployed in networks containing sensitive assets. No public patches have been reported; contact LB-Link to check for firmware update availability. In the meantime, implement strict local network access control (segmentation, VLANs) and monitor unauthorized access to router CGI endpoints. If use is limited to guest networks or non-critical areas, the risk is more contained.