CVE-2026-6824

HIGH 8.4

CP Plus 8 Ch. Network Video Recorder Cross-site Scripting

CVSS Score

8.4

EPSS Score

0.0%

EPSS Percentile

0th

A stored cross-site scripting (XSS) vulnerability exists in certain 1xxx series NVR devices due to insufficient sanitization of user-supplied input in specific functional modules. Attackers can inject malicious scripts, which are then persistently stored on the device backend. When administrators or users access affected pages, the stored scripts are executed in their browsers, leading to potential session hijacking, unauthorized actions, or data theft.

CWE	CWE-79
Vendor	cp plus
Product	cp-unr-108f1 hardware
Published	May 29, 2026
Last Updated	May 29, 2026

Stay Ahead of the Next One

Get instant alerts for cp plus cp-unr-108f1 hardware

Be the first to know when new high vulnerabilities affecting cp plus cp-unr-108f1 hardware are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

CP Plus / CP-UNR-108F1 Hardware

1.0

CP Plus / CP-UNR-108F1 Web

3.2.7.128806

CP Plus / CP-UNR-108F1 System

4.001.00AT009.0.R

References

NVD ↗ CVE.org ↗ EPSS Data ↗

drive.google.com: https://drive.google.com/file/d/1Ctxdp55UtlrQY7CSepkImM9zFgdcuCyL/view cisa.gov: https://www.cisa.gov/news-events/ics-advisories/icsa-26-148-05 github.com: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-148-05.json

Credits

Jithin Nambiar J reported this vulnerability to CISA.