CP Plus Network Video Recorders contain a stored XSS vulnerability (CVE-2026-6824)…
CP Plus Network Video Recorders contain a stored XSS vulnerability (CVE-2026-6824) allowing attackers to execute malicious scripts in administrator browsers, potentially compromising sessions and data.
CISA has disclosed a stored Cross-Site Scripting (XSS) vulnerability in CP Plus 8 Channel Network Video Recorder devices, specifically the CP-UNR-108F1 model running Hardware V1.0, Web V3.2.7.128806, and System V4.001.00AT009.0.R. The vulnerability stems from insufficient input sanitization in certain functional modules, allowing attackers to inject malicious scripts that persist on the device backend. When administrators or authenticated users access affected pages, these stored scripts execute in their browsers, potentially leading to session hijacking, unauthorized actions performed with victim privileges, data theft, and degradation of system integrity.
The vulnerability affects devices deployed across India, Nepal, United Arab Emirates, and Gambia, primarily impacting commercial facilities, critical manufacturing, and emergency services sectors. CP Plus has released firmware version CP-UNR-AxxxMars_PN_15_Q_00_V1.00.14.01.T.260326 to address this issue. No known public exploitation has been reported to CISA at the time of advisory publication.
CISA recommends organizations minimize network exposure for affected devices, ensure they are not accessible from the internet, and implement defense-in-depth strategies. Organizations should contact CP Plus support for firmware access and upgrade instructions, and perform proper impact analysis before deploying defensive measures.
Mentioned in this report
Detection guidance
Possible Stored XSS Injection Attempt Against Network Video Recorder Web Interface
Detects HTTP requests containing script injection patterns (e.g. <script>, javascript:, onerror=) submitted to NVR/DVR web management parameters, consistent with exploitation of stored XSS vulnerabilities such as CVE-2026-6824 in CP Plus NVR devices. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Possible Stored XSS Injection Attempt Against Network Video Recorder Web Interface
id: ec2f8ba0-f113-557c-bf57-c95403718b1d
status: experimental
description: 'Detects HTTP requests to embedded device web management interfaces (e.g.
NVR/DVR admin portals) that contain classic stored XSS injection payload patterns
in URL parameters or POST bodies, such as script tags, javascript URIs, or event
handler attributes. This is consistent with exploitation attempts of stored XSS
vulnerabilities like CVE-2026-6824 affecting CP Plus NVR devices, where malicious
scripts are persisted in device backend fields (e.g. camera names, user labels)
and later execute in an administrator''s browser.
'
references:
- https://www.cisa.gov/news-events/ics-advisories
author: Vorant
tags:
- attack.t1189
- attack.t1185
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- <script
- 'javascript:'
- onerror=
- onload=
- '%3Cscript'
- document.cookie
filter_encoded_benign:
cs-uri-query|contains:
- /favicon.ico
condition: selection and not filter_encoded_benign
falsepositives:
- Security scanners or vulnerability assessment tools actively probing device web
interfaces for XSS
- Legitimate configuration values that coincidentally include angle brackets or URL-encoded
characters
- Web application firewall or proxy logging test/health-check traffic containing similar
substrings
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-148-05
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free