CVE-2026-6824
CP Plus 8 Ch. Network Video Recorder Cross-site Scripting
- State
- Published
- Severity
- 8.4 High
- Published
- May 29, 2026
- Updated
- May 29, 2026
- Reserved
- Apr 21, 2026
Description
A stored cross-site scripting (XSS) vulnerability exists in certain 1xxx series NVR devices due to insufficient sanitization of user-supplied input in specific functional modules. Attackers can inject malicious scripts, which are then persistently stored on the device backend. When administrators or users access affected pages, the stored scripts are executed in their browsers, leading to potential session hijacking, unauthorized actions, or data theft.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.4 High | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H | icscert |
Weaknesses
- CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')
Affected Products
| Product | Versions |
|---|---|
CP-UNR-108F1 HardwareCP Plus |
|
CP-UNR-108F1 WebCP Plus |
|
CP-UNR-108F1 SystemCP Plus |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.