The CP-Plus EZ-P21 IP Camera suffers from CWE-307 due to improper authentication controls on its HTTP endpoints. This vulnerability enables remote attackers to conduct brute-force attacks against the device's authentication mechanism without any required privileges or user interaction. Successful exploitation results in unauthorized access to live video snapshots, compromising the confidentiality of the camera's video feed. No patch or official remediation has been documented yet, and no known exploits are reported in the wild as of the publication date.

An attacker exploiting this vulnerability can bypass authentication by brute forcing HTTP endpoints, gaining unauthorized access to live video snapshots from the affected IP camera. This compromises the confidentiality of video surveillance data, potentially exposing sensitive visual information to unauthorized parties.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device's HTTP interface to trusted networks only and monitor for unusual authentication attempts to reduce exposure.