CVE-2026-67596

This CVE exposes configuration backup files (Router.cfg) on CSL M2M gateways protected only by single-byte XOR obfuscation. The attack is trivial: capture the file, run a trivial decryption routine, extract WPA pre-shared keys, 3G/APN authentication credentials, and administrative telnet passwords. The CVSS of 6.2 badly understates the actual risk — exploit complexity is trivial but the blast radius is substantial, since the exposed credentials can grant access not just to the local network but to carrier infrastructure and backend systems that the M2M gateway communicates with. The deeper problem is that single-byte XOR in backup encryption isn't a one-off coding error — it's a genotype that has propagated through decades of embedded and M2M development, from early DSL routers through industrial SCADA to current IoT gateways. This device almost certainly inherited its cipher from a chipset vendor reference design that shipped with the XOR key as a hardcoded constant in example code. Every manufacturer who built on that reference design shipped the same vulnerability. If you find one, you may find thousands across different product names. What you should do: audit your asset inventory for CSL M2M gateways and any devices based on that reference design. Treat any captured Router.cfg file as compromised — rotate the WPA PSK, APN credentials, and administrative passwords immediately. There's no patch coming that won't break backward compatibility with existing configuration backups, and the remediation timeline for deployed M2M hardware is measured in years, not weeks. The severity scoring model fails here because CVSS treats exploit complexity as a proxy for likelihood, but for credential exposure via captured files, you only need one successful capture. The EPSS model's prevalence discount makes this worse — the question isn't how common the device is, it's what the blast radius is for the devices that exist.

Reviewed through automated stages and approved by a human before publication.