This vulnerability (CVE-2026-65893) affects the CP-Plus EZ-P21 IP Camera due to an active debug feature in its firmware that is insecurely enabled. The flaw allows an attacker who has physical access to the device to execute arbitrary code by placing malicious code on removable media and activating it through the debug functionality. This leads to code execution with elevated privileges, potentially compromising the device's security. The CVSS 4.0 score is 7.0, indicating high severity. There is no vendor advisory or patch information available at this time.

An attacker with physical access to the affected IP camera can execute arbitrary code with elevated privileges by exploiting the insecure debug feature. This could lead to full compromise of the device, unauthorized control, and potential further attacks on the network or data privacy breaches.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict physical access to the device to prevent exploitation. Disable or restrict debug features if possible through device configuration.