# CVE-2026-65893: CP PLUS EZ-P21 IP Camera arbitrary code execution via debug feature

Source: https://junglewise.ai/threats/cve-2026-65893-cp-plus-ez-p21-ip-camera-arbitrary-code-execution-via-debug  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-27. Updated: 2026-07-27  
License: CC BY 4.0 with a link back

CVE-2026-65893 · Severity: info · CVSS 7 · Published 2026-07-27

CP PLUS EZ-P21 IP cameras, which are used for video surveillance and remote monitoring, contain a security flaw in their firmware's debug mode. An individual with physical access to the camera can insert a storage device containing malicious code to take full control of the hardware. This could lead to a total loss of privacy, unauthorized video access, or the device being used as a foothold for further attacks on the local network.

Vendors: [CP Plus](https://junglewise.ai/threats/vendors/cp-plus).

## Quick answers

**Is CVE-2026-65893 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65893 being exploited in the wild.

**How severe is CVE-2026-65893?** Informational severity, with a CVSS score of 7, published 27 July 2026.

**Which products and versions are affected?** CP Plus EZ-P21 IP Camera v4.8.8.1 and prior.

**Is there a fix for CVE-2026-65893?** A patch was published on 2026-07-27: Firmware version 4.8.16.1 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-65893 attacked?** It is attacked with physical access, in a network appliance.

**Am I affected by CVE-2026-65893?** Check whether you run CP Plus EZ-P21 IP Camera at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability (CWE-489) stems from an active debug feature enabled in the firmware of CP PLUS EZ-P21 IP cameras. An attacker with physical access can exploit this by placing arbitrary code on removable media (such as an SD card) and triggering its execution through the device's debug mechanism. Successful exploitation results in arbitrary code execution with elevated privileges. The vulnerability is addressed in firmware version 4.8.16.1, which is available via Over-the-Air (OTA) update.

## Affected products

- CP PLUS EZ-P21 IP Camera v4.8.8.1 and prior

## Timeline

- 2026-07-27: advisory: CERT-In published vulnerability note CIVN-2026-0380
- 2026-07-27: patched: Firmware version 4.8.16.1 released to address the issue

## References

- [https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0380](https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0380)

## Related threats

- [CP PLUS EZ-P21 IP Camera improper authentication in HTTP endpoints](https://junglewise.ai/threats/cve-2026-65894-cp-plus-ez-p21-ip-camera-improper-authentication-in-http)