What’s Vulnerable › Vulnerabilities

CVE-2026-6824: CP Plus 8 Ch. Network Video Recorder Cross-site Scripting

• Severity: high (CVSS 8.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-29 · updated 2026-07-21
• Weakness: CWE-79

Description

A stored cross-site scripting (XSS) vulnerability exists in certain 1xxx series NVR devices due to insufficient sanitization of user-supplied input in specific functional modules. Attackers can inject malicious scripts, which are then persistently stored on the device backend. When administrators or users access affected pages, the stored scripts are executed in their browsers, leading to potential session hijacking, unauthorized actions, or data theft.

Affected products

• CP Plus CP-UNR-108F1 Hardware: 1.0
• CP Plus CP-UNR-108F1 System: 4.001.00AT009.0.R
• CP Plus CP-UNR-108F1 Web: 3.2.7.128806

References

• https://drive.google.com/file/d/1Ctxdp55UtlrQY7CSepkImM9zFgdcuCyL/view
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-148-05.json
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-148-05

Get alerted when CVE-2026-6824 or the next vulnerability affects your stack