🔐 Security Analysis of the CP PLUS EZ-P21 IP Camera

CVE-2026-65893 CVE-2026-65894

Arbitrary Code Execution & Improper Authentication – CP PLUS EZ-P21 IP Camera

---

Overview

This repository documents two security vulnerabilities identified in the CP PLUS EZ-P21 IP Camera, an IP-based surveillance camera used for video monitoring and network-based access to camera functions and snapshots.

Both issues were responsibly disclosed, coordinated through the vendor/CERT process, and assigned CVE identifiers.

---

Vulnerability Summary

---

1. CVE-2026-65893 — Arbitrary Code Execution

This vulnerability exists due to an insecure debug feature enabled in the firmware. An attacker with physical access could place arbitrary code on removable media and trigger its execution through the debug mechanism, resulting in code execution with elevated privileges.

2. CVE-2026-65894 — Improper Authentication

This vulnerability exists due to improper authentication of HTTP endpoints. A remote attacker could conduct brute-force attacks against the HTTP endpoint, gaining unauthorized access to live video snapshots from the targeted device.

See Vulnerability_Overview.md and Technical_Analysis.md for details.

⚠️ This repository is intended strictly for educational and research purposes. No exploit code or weaponized proof-of-concept is included.

---

Credit

Reported by a team of security researchers:

• Vishwa V — SRMIST Ramapuram
• Dr. Sathya Priya S — SRMIST Ramapuram
• Tiyyagura Venkata Shesha Shaina Reddy — Vignan University
• Isukapalli Venkata Mythreya Kumara Sarma — Vignan University
• Deven Lunkad — IIIT Allahabad
• Prof. S. Venkatesan — IIIT Allahabad

---

References

See References.md.

---

⭐ If you find this research useful, consider giving the repository a star.