CVE-2026-9274 PUBLISHED

Information Exposure Vulnerability in CP-Plus Wi-Fi Camera

Assigner: CERT-In
Reserved: 22.05.2026 Published: 25.05.2026 Updated: 25.05.2026

This vulnerability exists in CP Plus Wi-Fi Camera due to improper protection of sensitive information in runtime memory. An attacker with physical access could exploit this vulnerability by accessing the UART interface and performing memory extraction to obtain sensitive information, including cryptographic private keys, Wi-Fi credentials and configuration data stored in RAM of the targeted device.

Successful exploitation of this vulnerability could allow unauthorized access to encrypted communications and connected wireless network of the targeted device.

Metrics

CVSS Vector: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N
CVSS Score: 5.2

Product Status

Vendor CP Plus
Product Wi-Fi Camera CP-E38Q, CP-E48Q, CP-E25Q, CP-E35Q, CP-E45Q, CP-E28Q, CP-E21Q, CP-E31Q, CP-E41Q, CP-E24Q, CP-Z43Q, CP-E34Q, CP-E44Q, CP-T31Q, CP-V48Q, CP-V41Q, CP-Z45Q
Versions Default: unaffected
  • Version v02.21.031 or below is affected

Solutions

Upgrade CP Plus Wi-Fi Camera to the latest firmware version v02.21.041 through OTA using the Ezykam+ mobile application.https://cpplusworld.com/products/ezyhome/ezykam

Credits

  • This vulnerability is reported by Mohsin Quresh. finder

References

Problem Types

  • CWE-312: Cleartext Storage of Sensitive Information CWE

Impacts

  • CAPEC-37 Retrieve Embedded Sensitive Data