What is CVE-2026-6824?

CVE-2026-6824 is a high-severity vulnerability in Cp Plus Cp-Unr-108f1 Hardware, classified under Cross-site Scripting. CVSS score: 8.4/10. Published 2026-05-29.

How severe is CVE-2026-6824?

High severity. CVSS v3 base score is 8.4 out of 10.

XSS in Cp Plus Cp-Unr-108f1 Hardware

CVE-2026-6824

A stored cross-site scripting (XSS) vulnerability exists in certain 1xxx series NVR devices due to insufficient sanitization of user-supplied input in specific functional modules. Attackers can inject malicious scripts, which are then persistently stored on the device backend. When administrators or users access affected pages, the stored scripts are executed in their browsers, leading to potential session hijacking, unauthorized actions, or data theft.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.004 (30.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.4 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H.

Affected products

Cp Plus Cp-unr-108f1 Hardware — versions 1.0
Cp Plus Cp-unr-108f1 System — versions 4.001.00AT009.0.R
Cp Plus Cp-unr-108f1 Web — versions 3.2.7.128806

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

Frequently asked questions

What is CVE-2026-6824?: CVE-2026-6824 is a high-severity vulnerability in Cp Plus Cp-Unr-108f1 Hardware, classified under Cross-site Scripting. CVSS score: 8.4/10. Published 2026-05-29.
How severe is CVE-2026-6824?: High severity. CVSS v3 base score is 8.4 out of 10.