CP Plus Wi-Fi Camera CVE-2026-9274

Q: What is the CVSS score of CVE-2026-9274?

CVE-2026-9274 has a CVSS 4.0 base score of 5.2 (Medium). CVSS vector: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31661 MEDIUM

Cleartext Storage of Sensitive Information (CWE-312)

2026-05-25 CERT-In

GHSA-6c6p-vqc7-gj3w

Authentication Bypass Wi Fi Camera Cp E38Q Cp E48Q Cp E25Q Cp E35Q Cp E45Q Cp E28Q Cp E21Q Cp E31Q Cp E41Q Cp E24Q Cp Z43Q Cp E34Q Cp E44Q Cp T31Q Cp V48Q Cp V41Q Cp Z45Q Cp Plus

5.2

CVSS 4.0 · Vendor: CERT-In

Severity by source

Vendor (CERT-In) PRIMARY

5.2 MEDIUM

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.2 MEDIUM

Physical-only UART hardware attack with no software auth required; high confidentiality impact from key/credential extraction; low integrity impact from potential UART write capability; no availability impact described.

3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (CERT-In).

CVSS VectorVendor: CERT-In

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:21 vuln.today

CVE Published

May 25, 2026 - 09:19 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

This vulnerability exists in CP Plus Wi-Fi Camera due to improper protection of sensitive information in runtime memory. An attacker with physical access could exploit this vulnerability by accessing the UART interface and performing memory extraction to obtain sensitive information, including cryptographic private keys, Wi-Fi credentials and configuration data stored in RAM of the targeted device.

Successful exploitation of this vulnerability could allow unauthorized access to encrypted communications and connected wireless network of the targeted device.

AnalysisAI

Memory extraction via the UART debug interface on CP Plus Wi-Fi Camera firmware v02.21.031 and below exposes cryptographic private keys, Wi-Fi credentials, and device configuration stored unprotected in runtime RAM. An attacker with physical access to an affected device can connect to the hardware UART port and dump memory contents without software-level authentication, yielding secrets sufficient to join the protected wireless network and decrypt communications. No public exploit code exists and EPSS is 0.01% (2nd percentile), with SSVC confirming no known exploitation - risk is confined to physical-access scenarios such as device theft, rogue insiders, or supply-chain compromise.

Technical ContextAI

CWE-312 (Cleartext Storage of Sensitive Information) is the root cause - the device firmware does not protect sensitive runtime data before storing it in RAM, leaving cryptographic private keys and Wi-Fi pre-shared keys in recoverable cleartext during normal operation. The UART (Universal Asynchronous Receiver/Transmitter) interface is a hardware serial debug port present on most embedded IoT devices; it typically exposes a shell or memory bus access with no software authentication. An attacker with the appropriate UART-to-USB adapter and a serial terminal can read directly from the device's RAM address space. The affected CPE covers 17 specific model identifiers - CP-E38Q, CP-E48Q, CP-E25Q, CP-E35Q, CP-E45Q, CP-E28Q, CP-E21Q, CP-E31Q, CP-E41Q, CP-E24Q, CP-Z43Q, CP-E34Q, CP-E44Q, CP-T31Q, CP-V48Q, CP-V41Q, and CP-Z45Q - all manufactured by CP Plus and confirmed affected at firmware v02.21.031 and below per EUVD-2026-31661.

RemediationAI

Apply the firmware update for affected CP Plus Wi-Fi Camera models by consulting the CERT-In advisory at https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0266 and contacting CP Plus support for the current patched firmware release - the exact fixed firmware version number is not independently confirmed in available data, so do not assume a specific version without vendor confirmation. As immediate compensating controls: physically secure all deployed cameras using tamper-evident enclosures or locked mounts to deny UART port access to unauthorized individuals, as this is the single gate that blocks exploitation. For cameras that may have been left unattended in accessible locations, treat Wi-Fi credentials and any cryptographic material as compromised - rotate the Wi-Fi passphrase and re-provision affected certificates. Segment surveillance cameras onto a dedicated VLAN with no lateral access to sensitive network segments, so that even if Wi-Fi credentials are extracted, the blast radius is limited. Disabling or physically covering UART debug headers (e.g., with epoxy or header covers) is an option on some hardware revisions but will prevent legitimate field debugging - weigh this trade-off based on deployment sensitivity.