CP Plus Wi-Fi Camera EUVD-2026-31661

Physical access to the camera hardware is the absolute and non-negotiable prerequisite - the attack targets the UART serial debug interface, a hardware port that requires direct physical connection using a UART-to-USB adapter and serial terminal software. Exploitation requires the camera to be running firmware v02.21.031 or below. No software-level authentication is required once the UART connection is established (reflected by PR:N in the CVSS 4.0 vector). Exploitation is limited by: (1) mandatory physical proximity - this vulnerability has no remote attack surface whatsoever; (2) requirement for hardware tools and knowledge of the device's UART pinout; (3) the attack targets one device at a time and is not automatable across a fleet. The attack is not conditioned on any specific camera feature being enabled - the insecure memory handling is present in the base firmware of all listed models.

Real-world risk is substantially constrained by the physical access requirement. The CVSS 4.0 score of 5.2 with AV:P correctly reflects that the attack surface is limited to adversaries who can physically handle the device. EPSS at 0.01% (2nd percentile) and SSVC Exploitation: none confirm no observed or anticipated automated exploitation. SSVC also rates the attack as non-automatable, consistent with the one-device-at-a-time, hands-on nature of UART memory extraction. However, the confidentiality impact is genuinely high - VC:H in the provided CVSS 4.0 vector and the nature of what is exposed (private keys and network credentials) means that successful exploitation is not merely information disclosure but a full compromise enabler. SC:L in the CVSS 4.0 vector captures the downstream impact on the connected wireless network. For most deployments this does not warrant emergency response, but environments where cameras are physically accessible to untrusted parties (public spaces, rented facilities, high-staff-turnover sites) or where the wireless network carries sensitive traffic face meaningful risk from this class of attack.

An adversary steals or gains temporary unmonitored physical access to an affected CP Plus camera - for example, during a break-in or as a rogue facilities contractor - and connects a UART-to-USB adapter to the device's debug header using a serial terminal at standard baud rates. Within minutes, a memory dump yields the Wi-Fi pre-shared key in cleartext, which the attacker uses to join the protected wireless network from a nearby vehicle, and the extracted private key material to decrypt previously captured TLS communications. No public exploit code has been identified at time of analysis, but the technique requires only commodity hardware and publicly documented UART memory extraction methodology.