This vulnerability (CVE-2026-9274) in CP Plus Wi-Fi Cameras arises from improper protection of sensitive information in runtime memory (CWE-312). An attacker with physical access to the device's UART interface can perform memory extraction to retrieve sensitive data such as cryptographic private keys, Wi-Fi credentials, and configuration details stored in RAM. The affected products include multiple CP Plus camera models running firmware version v02.21.031 or below. The CVSS 4.0 base score is 5.2 (medium severity), reflecting the requirement for physical access and the potential impact on confidentiality of encrypted communications and wireless network access. No vendor advisory or patch is currently available, and no known exploits have been reported.

Successful exploitation allows an attacker with physical access to extract sensitive information from device memory, including cryptographic keys and Wi-Fi credentials. This can lead to unauthorized decryption of communications and unauthorized access to the wireless network connected to the camera. The impact is limited by the need for physical access and specialized knowledge to access the UART interface and perform memory extraction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict physical access to affected devices to prevent exploitation. Monitor vendor communications for updates regarding patches or mitigations.