This vulnerability (CWE-312) in CP Plus Wi-Fi cameras arises from improper protection of sensitive information in runtime memory. An attacker with physical access to the device can access the UART interface to extract memory contents, revealing sensitive data including cryptographic keys and Wi-Fi credentials. The affected models include CP-E38Q, CP-E48Q, CP-E25Q, CP-E35Q, CP-E45Q, CP-E28Q, CP-E21Q, CP-E31Q, CP-E41Q, CP-E24Q, CP-Z43Q, CP-E34Q, CP-E44Q, CP-T31Q, CP-V48Q, CP-V41Q, and CP-Z45Q running firmware version v02.21.031 or below. The CVSS 4.0 base score is 5.2, indicating medium severity, with attack vector requiring physical access and no privileges or user interaction needed. The vulnerability impacts confidentiality by exposing sensitive runtime data.

Successful exploitation allows an attacker with physical access to extract sensitive information such as cryptographic private keys and Wi-Fi credentials from device memory. This can lead to unauthorized decryption of communications and unauthorized access to the wireless network connected to the camera. The impact is limited by the requirement for physical access and specialized knowledge to access the UART interface.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict physical access to affected devices to mitigate risk. Monitor vendor communications for updates on patches or mitigations.