PT-2026-44969 · Cp Plus · Cp Plus 1Xxx Series Nvr

Jithin Nambiar J · Published 2026-05-29 · Updated 2026-05-29 · CVE-2026-6824

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CP Plus 1xxx series NVR (affected versions not specified)

Description A stored cross-site scripting (XSS) issue exists due to insufficient sanitization of user-supplied input in specific functional modules. This allows attackers to inject malicious scripts that are persistently stored on the device backend. When administrators or users access the affected pages, these scripts execute in their browsers, which can lead to data theft, unauthorized actions, or session hijacking (the unauthorized acquisition of a user session token to impersonate the user).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-6824

Affected Products

Cp Plus 1Xxx Series Nvr

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-6824 · Security Note
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-148-05.json · Note
• https://cisa.gov/news-events/ics-advisories/icsa-26-148-05 · Note
• https://drive.google.com/file/d/1Ctxdp55UtlrQY7CSepkImM9zFgdcuCyL/view · Note
• https://t.me/CVEtracker/55289 · Telegram Post