Skip to content
CVE PROGRAM SOURCE RECORD8.4 High

CVE-2026-6824

CP Plus 8 Ch. Network Video Recorder Cross-site Scripting

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
icscert

Description

A stored cross-site scripting (XSS) vulnerability exists in certain 1xxx series NVR devices due to insufficient sanitization of user-supplied input in specific functional modules. Attackers can inject malicious scripts, which are then persistently stored on the device backend. When administrators or users access affected pages, the stored scripts are executed in their browsers, leading to potential session hijacking, unauthorized actions, or data theft.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

CP Plus CP-UNR-108F1 Hardware

Default version status: unaffected

  • 1.0affected

CP Plus CP-UNR-108F1 Web

Default version status: unaffected

  • 3.2.7.128806affected

CP Plus CP-UNR-108F1 System

Default version status: unaffected

  • 4.001.00AT009.0.Raffected

References