CVE-2026-9274 Information Exposure Vulnerability in CP-Plus Wi-Fi Camera
An attacker with physical access can extract sensitive data like keys and credentials from memory via UART, compromising encrypted communications and network access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-9274?
CVE-2026-9274 is a medium-severity vulnerability in Wi-Fi Camera CP-E38Q, CP-E48Q, CP-E25Q, CP-E35Q, CP-E45Q, CP-E28Q, CP-E21Q, CP-E31Q, CP-E41Q, CP-E24Q, CP-Z43Q, CP-E34Q, CP-E44Q, CP-T31Q, CP-V48Q, CP-V41Q, CP-Z45Q, published on 25 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
This vulnerability exists in CP Plus Wi-Fi Camera due to improper protection of sensitive information in runtime memory. An attacker with physical access could exploit this vulnerability by accessing the UART interface and performing memory extraction to obtain sensitive information, including cryptographic private keys, Wi-Fi credentials and configuration data stored in RAM of the targeted device.
Successful exploitation of this vulnerability could allow unauthorized access to encrypted communications and connected wireless network of the targeted device.
Weakness: CWE-312
Which versions are affected by CVE-2026-9274?
How do I fix CVE-2026-9274?
No fix has been published for CVE-2026-9274 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-9274 being exploited?
There is no known exploitation of CVE-2026-9274 in the wild and no public exploit code.
Sources
Also known as GHSA-6c6p-vqc7-gj3w.