CP Plus NVR EUVD-2026-33363

Exploitation requires the attacker to already authenticate to the CP Plus CP-UNR-108F1 NVR web interface with high privileges (CVSS PR:H) sufficient to write into one of the specific functional modules whose inputs are not sanitized, and a separate administrator or user must subsequently load the affected management page in a browser for the stored payload to execute (CVSS UI:R). The device's web management interface must be network-reachable from the attacker (AV:N), which in well-segmented CCTV deployments is typically limited to a management VLAN. Limiting factors: the privilege prerequisite blocks anonymous internet-wide abuse, the user-interaction requirement means the payload only fires when a victim browses the poisoned page, and exposure is bounded to the CP Plus 1xxx series - specifically the CP-UNR-108F1 hardware/web/system components named in the CPE data.

The CVSS:3.1 vector AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H combines network reachability and low complexity with two meaningful limiters: PR:H means the attacker must already hold high privileges on the device, and UI:R means an administrator must visit the poisoned page for the payload to fire - these constraints are why the score is 8.4 rather than 9.x despite Scope:Changed and triple-High CIA impact. No EPSS score, KEV listing, or POC reference is present in the supplied data, so this should be treated as no public exploit identified at time of analysis; the entry was reported through ICS-CERT (CISA ICSA-26-148-05), indicating responsible disclosure rather than observed in-the-wild abuse. Real-world priority is moderate: highest for organizations exposing NVR admin interfaces to shared networks or hosting multiple operator accounts with differing trust, lower where the device sits on an isolated CCTV VLAN with a single administrator - but stored XSS on a privileged appliance is a strong pivot for insider-to-admin escalation and should be patched on the standard ICS cadence.

An attacker who has obtained or been granted a high-privileged operator account on a CP Plus CP-UNR-108F1 NVR submits a JavaScript payload through one of the vulnerable functional modules (for example, a device, channel, or user-profile field), where it is persisted to the backend. When a higher-privileged administrator subsequently opens the management page that renders that field, the script executes in their authenticated session and silently issues admin-level API calls - changing credentials, exfiltrating recorded video, or disabling logging. No public exploit code has been identified at time of analysis, but the attack pattern is straightforward stored-XSS tradecraft requiring no novel research.