PT-2026-66507 · Csl Mobile Limited · Csl 1010 M2M 3G Wifi Module

Gjoko Krstic · CVE-2026-67596 · Published 2026-07-30 · Updated 2026-07-30

NVD

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CSL 1010 M2M 3G WiFi Module firmware through 2.2.1.4 contains a weak encryption vulnerability that allows unauthenticated attackers to recover all stored secrets in plaintext by reversing a single-byte XOR cipher with a static key applied to the configuration backup file. Attackers can trivially decrypt the Router.cfg backup file to expose web administration and telnet passwords, WPA/WPA2 pre-shared keys, PPPoE and 3G/APN credentials, and SIM identifiers including IMSI and IMEI.

Fix

Weakness Enumeration

CWE-261

Related Identifiers

CVE-2026-67596

Affected Products

Csl 1010 M2M 3G Wifi Module

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-67596 · Security Note
• https://1010.com.hk · Note
• https://zeroscience.mk/#/advisories/ZSL-2026-6000 · Note
• https://vulncheck.com/advisories/csl-1010-m2m-3g-wifi-module-weak-encryption-via-router-cfg · Note