CVE-2026-6824

A stored cross-site scripting (XSS) vulnerability exists in certain 1xxx series NVR devices due to insufficient sanitization of user-supplied input in specific functional modules. Attackers can inject malicious scripts, which are then persistently stored on the device backend. When administrators or users access affected pages, the stored scripts are executed in their browsers, leading to potential session hijacking, unauthorized actions, or data theft.

CVSS v3 8.4 HIGH

8.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.7 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://drive.google.com/file/d/1Ctxdp55UtlrQY7CSepkImM9zFgdcuCyL/view
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-148-05.json
https://www.cisa.gov/news-events/ics-advisories/icsa-26-148-05

Configurations

No configuration.

History

No history.

Information

Published : 2026-05-29 18:17

Updated : 2026-07-21 18:10

NVD link : CVE-2026-6824

Mitre link : CVE-2026-6824

CVE.ORG link : CVE-2026-6824

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-6824", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6824", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-29T19:38:12.324339Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.7}]}, "affected": [{"source": "ics-cert@hq.dhs.gov", "affectedData": [{"vendor": "CP Plus", "product": "CP-UNR-108F1 Hardware", "versions": [{"status": "affected", "version": "1.0"}], "defaultStatus": "unaffected"}, {"vendor": "CP Plus", "product": "CP-UNR-108F1 Web", "versions": [{"status": "affected", "version": "3.2.7.128806"}], "defaultStatus": "unaffected"}, {"vendor": "CP Plus", "product": "CP-UNR-108F1 System", "versions": [{"status": "affected", "version": "4.001.00AT009.0.R"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-29T18:17:13.147", "references": [{"url": "https://drive.google.com/file/d/1Ctxdp55UtlrQY7CSepkImM9zFgdcuCyL/view", "source": "ics-cert@hq.dhs.gov"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-148-05.json", "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-148-05", "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A stored cross-site scripting (XSS) vulnerability exists in certain 1xxx series NVR devices due to insufficient sanitization of user-supplied input in specific functional modules. Attackers can inject malicious scripts, which are then persistently stored on the device backend. When administrators or users access affected pages, the stored scripts are executed in their browsers, leading to potential session hijacking, unauthorized actions, or data theft."}, {"lang": "es", "value": "Una vulnerabilidad de cross-site scripting (XSS) almacenado existe en ciertos dispositivos NVR de la serie 1xxx debido a una sanitizaci\u00f3n insuficiente de la entrada proporcionada por el usuario en m\u00f3dulos funcionales espec\u00edficos. Los atacantes pueden inyectar scripts maliciosos, los cuales son luego almacenados persistentemente en el backend del dispositivo. Cuando los administradores o usuarios acceden a las p\u00e1ginas afectadas, los scripts almacenados se ejecutan en sus navegadores, lo que lleva a un posible secuestro de sesi\u00f3n, acciones no autorizadas o robo de datos."}], "lastModified": "2026-07-21T18:10:00.117", "sourceIdentifier": "ics-cert@hq.dhs.gov"}