A-Plus Video Technologies NVR firmware contains a flaw that allows remote attackers to reach an unsecured debug page without authentication. By accessing this page, an attacker can view device status information, which may include configuration details, network layout, or other sensitive data. The vulnerability is classified under CWE‑497, indicating that sensitive information can be read without proper controls.

A-Plus Video Technologies models AP‑BS404, AP‑BS408, AP‑BS416, AP‑RM816, AP‑RM832, AP‑RM832P, AP‑RM864, and AP‑RM864P are affected. Firmware versions earlier than 2.2.0 are vulnerable; devices running 2.2.0 or later include the fix.

The CVSS score of 6.9 reflects a moderate severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation at the time of analysis. The flaw is not listed in CISA’s KEV catalog. Attackers can exploit it by sending HTTP requests to the network interface of the NVR and retrieving the debug page, assuming the device is exposed to the Internet or an attacker’s local network.