The CVE exposes sensitive data such as cryptographic private keys, Wi‑Fi credentials, and configuration information stored in the device’s RAM. A malicious party could read this data by accessing the UART interface and extracting memory contents, thereby compromising encrypted communications and the network the camera is connected to.

CP Plus Wi‑Fi Camera models CP‑E38Q, CP‑E48Q, CP‑E25Q, CP‑E35Q, CP‑E45Q, CP‑E28Q, CP‑E21Q, CP‑E31Q, CP‑E41Q, CP‑24Q, CP‑Z43Q, CP‑E34Q, CP‑E44Q, CP‑T31Q, CP‑V48Q, CP‑V41Q, CP‑Z45Q running firmware version v02.21.031 or earlier are affected.

The CVSS score of 5.2 indicates moderate severity. No EPSS score is available and the vulnerability is not listed in CISA KEV, suggesting limited public exploitation. The attack requires physical access to the UART interface, so the threat surface is limited to situations where an attacker can physically reach the device. If successfully exploited, the attacker could steal keys and credentials, enabling unauthorized network access and potentially decrypting communications.