High 8.4Published May 29, 2026

CVE-2026-6824CP Plus 8 Ch. Network Video Recorder Cross-site Scripting

Updated under an hour ago (Oct 26, 2026, 6:10 PM ET)

Does this affect you?

It affects CP Plus CP-UNR-108F1 Hardware and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for CP Plus CP-UNR-108F1 Hardware

Exploited in the last 30 days

A stored cross-site scripting (XSS) vulnerability exists in certain 1xxx series NVR devices due to insufficient sanitization of user-supplied input in specific functional modules. Attackers can inject malicious scripts, which are then persistently stored on the device backend. When administrators or users access affected pages, the stored scripts are executed in their browsers, leading to potential session hijacking, unauthorized actions, or data theft.

CVSS: 8.4 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Weakness (CWE): CWE-79
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: icscert
NVD analysis: Awaiting Analysis
Record last updated: May 29, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

CP Plus CP-UNR-108F1 Hardware cp_plus:cp_unr_108f1_hardware (from the name)	1.0	CNA record
CP Plus CP-UNR-108F1 Web cp_plus:cp_unr_108f1_web (from the name)	3.2.7.128806	CNA record
CP Plus CP-UNR-108F1 System cp_plus:cp_unr_108f1_system (from the name)	4.001.00AT009.0.R	CNA record

References

References

https://drive.google.com/file/d/1Ctxdp55UtlrQY7CSepkImM9zFgdcuCyL/view
https://www.cisa.gov/news-events/ics-advisories/icsa-26-148-05
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-148-05.json

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.