CVE-2026-65894

This vulnerability exists in CP PLUS EZ-P21 IP Camera due to improper authentication of HTTP endpoints. A remote attacker could exploit this vulnerability by conducting brute-force attacks against HTTP endpoint on the targeted device. Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to live video snapshots from the targeted device.

CVSS

No CVSS.

References

Link	Resource
https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0380

Configurations

No configuration.

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Esta vulnerabilidad existe en la cámara IP CP PLUS EZ-P21 debido a una autenticación inadecuada de los puntos finales HTTP. Un atacante remoto podría explotar esta vulnerabilidad mediante la realización de ataques de fuerza bruta contra el punto final HTTP en el dispositivo objetivo. La explotación exitosa de esta vulnerabilidad podría permitir a un atacante obtener acceso no autorizado a instantáneas de video en vivo del dispositivo objetivo.

Information

Published : 2026-07-27 08:16

Updated : 2026-10-24 13:10

NVD link : CVE-2026-65894

Mitre link : CVE-2026-65894

CVE.ORG link : CVE-2026-65894

JSON object : View

Products Affected

No product.

CWE

CWE-307

Improper Restriction of Excessive Authentication Attempts

{"id": "CVE-2026-65894", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-65894", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-27T10:25:32.964481Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "vdisclose@cert-in.org.in", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "vdisclose@cert-in.org.in", "affectedData": [{"vendor": "CP-Plus", "product": "EZ-P21 IP Camera", "versions": [{"status": "affected", "version": "version v4.8.8.1 and prior"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-27T08:16:23.157", "references": [{"url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0380", "source": "vdisclose@cert-in.org.in"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "vdisclose@cert-in.org.in", "description": [{"lang": "en", "value": "CWE-307"}]}], "descriptions": [{"lang": "en", "value": "This vulnerability exists in CP PLUS EZ-P21 IP Camera due to improper authentication of HTTP endpoints. A remote attacker could exploit this vulnerability by conducting brute-force attacks against HTTP endpoint on the targeted device.\n\n\n\nSuccessful exploitation of this vulnerability could allow an attacker to gain unauthorized access to live video snapshots from the targeted device."}, {"lang": "es", "value": "Esta vulnerabilidad existe en la c\u00e1mara IP CP PLUS EZ-P21 debido a una autenticaci\u00f3n inadecuada de los puntos finales HTTP. Un atacante remoto podr\u00eda explotar esta vulnerabilidad mediante la realizaci\u00f3n de ataques de fuerza bruta contra el punto final HTTP en el dispositivo objetivo.\n\nLa explotaci\u00f3n exitosa de esta vulnerabilidad podr\u00eda permitir a un atacante obtener acceso no autorizado a instant\u00e1neas de video en vivo del dispositivo objetivo."}], "lastModified": "2026-10-24T13:10:00.147", "sourceIdentifier": "vdisclose@cert-in.org.in"}