CVE-2026-0853
Sensitive Data Exposure in A-Plus NVRs via Debug Page Access
Publication date: 2026-01-12
Last updated on: 2026-01-12
Assigner: TWCERT/CC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| a-plus_video_technologies | nvr | to 2.2.0 (exc) |
| jingzhan_video_technology | nvr | to 2.2.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-497 | The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-0853 is a Sensitive Data Exposure vulnerability affecting certain Network Video Recorder (NVR) models developed by A-Plus Video Technologies and Jingzhan Video Technology. It allows unauthenticated remote attackers to access the device's debug page and obtain sensitive device status information without requiring any privileges or user interaction. This vulnerability affects specific models running firmware version 2.1.0 or earlier. [1, 2]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing unauthenticated remote attackers to access sensitive device status information through the debug page of affected NVR devices. Although it does not allow modification or disruption of the device, the exposure of sensitive information could aid attackers in further attacks or reconnaissance, potentially compromising the security of your surveillance system. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking if your NVR device is one of the affected models (AP-RM864P, AP-RM864, AP-RM832P, AP-RM832, AP-RM816, AP-BS416, AP-BS408, AP-BS404) running firmware version 2.1.0 or earlier. Additionally, you may attempt to access the debug page remotely without authentication to see if device status information is exposed. Specific commands are not provided in the resources. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to update the firmware of the affected NVR models to version 2.2.0 or later. [1, 2]