CP Plus 8 Ch. Network Video Recorder Cross-site Scripting

Description

A stored cross-site scripting (XSS) vulnerability exists in certain 1xxx series NVR devices due to insufficient sanitization of user-supplied input in specific functional modules. Attackers can inject malicious scripts, which are then persistently stored on the device backend. When administrators or users access affected pages, the stored scripts are executed in their browsers, leading to potential session hijacking, unauthorized actions, or data theft.

Scores

EPSS (exploitation in 30 days)

0.37% · top 69% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.4.

Weakness

• CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') (opens in a new tab)All about CWE-79 and its CVEs

Affected products

• CP Plus · CP-UNR-108F1 Hardware

  • affected 1.0

• CP Plus · CP-UNR-108F1 Web

  • affected 3.2.7.128806

• CP Plus · CP-UNR-108F1 System

  • affected 4.001.00AT009.0.R

What to do

Solution: CP Plus recommends updating the firmware on the device to the latest firmware version. CP-UNR-AxxxMars_PN_15_Q_00_V1.00.14.01.T.260326 can be downloaded at: https://drive.google.com/file/d/1Ctxdp55UtlrQY7CSepkImM9zFgdcuCyL/view For firmware access and upgrade instructions, please contact CP Plus support at: Phone: +91-8800952952 Email:  [email protected] mailto:[email protected]

References (3)

• https://drive.google.com/file/d/1Ctxdp55UtlrQY7CSepkImM9zFgdcuCyL/view (opens in a new tab)
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-148-05 (opens in a new tab)
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-148-05.json (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-6824](https://trackcve.app/badge/CVE-2026-6824.svg)](https://trackcve.app/cve/CVE-2026-6824)

Record last updated 29 May 2026, 19:38 UTC.