Documents CP PLUS EZ-P21 IP camera CVEs: arbitrary code execution via debug feature and improper authentication of HTTP endpoints, with responsible disclosure.
CVE-2026-65893 CVE-2026-65894
This repository documents two security vulnerabilities identified in the CP PLUS EZ-P21 IP Camera, an IP-based surveillance camera used for video monitoring and network-based access to camera functions and snapshots.
Both issues were responsibly disclosed, coordinated through the vendor/CERT process, and assigned CVE identifiers.
| CVE | Title | CWE | CVSS v4.0 | Attack Vector |
|---|---|---|---|---|
| CVE-2026-65893 | Arbitrary Code Execution via Insecure Debug Feature | CWE-489 (Active Debug Code) | 7.0 (High) | Local (Physical) |
| CVE-2026-65894 | Improper Authentication of HTTP Endpoints | CWE-287 (Improper Authentication) | 8.7 (High) | Remote Network |
This vulnerability exists due to an insecure debug feature enabled in the firmware. An attacker with physical access could place arbitrary code on removable media and trigger its execution through the debug mechanism, resulting in code execution with elevated privileges.
This vulnerability exists due to improper authentication of HTTP endpoints. A remote attacker could conduct brute-force attacks against the HTTP endpoint, gaining unauthorized access to live video snapshots from the targeted device.
See Vulnerability_Overview.md and Technical_Analysis.md for details.
⚠️ This repository is intended strictly for educational and research purposes. No exploit code or weaponized proof-of-concept is included.
Reported by a team of security researchers:
See References.md.
⭐ If you find this research useful, consider giving the repository a star.
