CVE-2026-6824CP Plus 8 Ch. Network Video Recorder Cross-site Scripting
- 8.4HighCVSS base score
- 0.37%Exploitation in 30 daysEPSS · top 68% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
A stored cross-site scripting (XSS) vulnerability exists in certain 1xxx series NVR devices due to insufficient sanitization of user-supplied input in specific functional modules. Attackers can inject malicious scripts, which are then persistently stored on the device backend. When administrators or users access affected pages, the stored scripts are executed in their browsers, leading to potential session hijacking, unauthorized actions, or data theft.
Timeline
ID reserved
By icscert
- 38 days later
· 38 days later
Published
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| icscertCNA (assigner) | 3.1 | High8.4 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H |
| NVDNVD · Awaiting Analysis | 3.1 | High8.4 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.37% · top 68% of all CVEs (15 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.4.
Affected products
CP Plus · CP-UNR-108F1 Hardware
- affected 1.0
- affected 3.2.7.128806
- affected 4.001.00AT009.0.R
What to do
Solution: CP Plus recommends updating the firmware on the device to the latest firmware version. CP-UNR-AxxxMars_PN_15_Q_00_V1.00.14.01.T.260326 can be downloaded at: https://drive.google.com/file/d/1Ctxdp55UtlrQY7CSepkImM9zFgdcuCyL/view For firmware access and upgrade instructions, please contact CP Plus support at: Phone: +91-8800952952 Email: [email protected] mailto:[email protected]
References
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-33363 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-6824)Record last updated .