Aditya Infotech Ltd. (CP Plus) — 3 prefixes (MA-L)

Aditya Infotech Ltd. holds three IEEE MA-L blocks — 28:18:FD, 5C:35:48, and F8:20:97 — all registered to the same address at Khemka Square, A-12, Sector-4, Noida, Uttar Pradesh 201301, India. The company is best known by its CP Plus brand and is the largest Indian-owned video-security and surveillance vendor, with roughly a fifth of the domestic Indian market; it filed for a public listing under the NSE ticker CPPLUS in 2025. These OUIs sit on networked surveillance hardware: IP and AI security cameras, thermal and body-worn cameras, smart Wi-Fi cameras and doorbells, Network Video Recorders (NVRs), HDCVI DVRs, and routers, with manufacturing in Kadapa, Andhra Pradesh. For anyone classifying network assets, a device presenting one of these prefixes is most likely a CP Plus camera, NVR, or router — a category worth treating as higher-risk when exposed to the internet. CP Plus runs a public security-advisory program, and its products carry several disclosed CVEs, including a 2026 CISA ICS advisory (ICSA-26-148-05) for a stored XSS in its 1xxx-series NVR line. A common data-quality trap: third-party lookup sites display "registration dates" for these prefixes (e.g. 2011-11-13, 2024-02-09, 2025-08-07), but IEEE publishes no OUI registration dates — those values are database snapshot artifacts and must not be recorded as IEEE facts.

IEEE assignment

3 prefixes → Aditya Infotech Ltd., registered Noida, Uttar Pradesh, IN [Confirmed] — IEEE MA-L / https://maclookup.app/vendors/aditya-infotech-ltd

Registry / block size

MA-L (24-bit OUI); holds 3 IEEE prefixes (28:18:FD, 5C:35:48, F8:20:97 ≈ 48M addresses) [Confirmed] — maclookup.app (IEEE-sourced). NOTE: IEEE's public OUI data publishes NO assignment/registration date; any "date registered" on third-party tools (e.g. 2011-11-13, 2024-02-09, 2025-08-07 on maclookup.app) is a database artifact, not an IEEE fact.

HQ / country

Khemka Square, A-12, Sector-4, Noida, Uttar Pradesh 201301, India (registry address); R&D in Noida, manufacturing in Kadapa, Andhra Pradesh [Confirmed] — IEEE MA-L / https://www.icicidirect.com/mailcontent/idirect_adityainfotech_iporeview-jul_25.pdf

Company status

active; publicly listed (NSE: CPPLUS, IPO 2025, price band ₹640–675) [Confirmed] — https://finance.yahoo.com/quote/CPPLUS.NS/ / https://www.icicidirect.com/mailcontent/idirect_adityainfotech_iporeview-jul_25.pdf

Device types

IP/AI security cameras, thermal/body-worn/dash cameras, smart Wi-Fi cameras & doorbells, NVRs, HDCVI DVRs, routers [Confirmed] — https://www.adityagroup.com/our-brands / https://cpplusworld.com/

Brands

CP Plus (primary consumer/pro brand); OnVigil (command-and-control monitoring); also distributes Dahua-brand cameras in India [Confirmed] — https://www.adityagroup.com/our-brands

Verified sample prefixes (all MA-L, Aditya Infotech Ltd.)

28:18:FD, 5C:35:48, F8:20:97 [Confirmed] — IEEE MA-L / https://maclookup.app/vendors/aditya-infotech-ltd

MAM / OUI-36 entries

none found (no MA-M or MA-S blocks for this org) [Confirmed] — IEEE registry

Allocated date

Unknown — IEEE publishes no OUI registration date; left null, not fabricated [Unknown] — IEEE the IEEE MA-L registry schema

Market position

largest Indian-owned video-security and surveillance vendor (~20.8% India market share, FY2025); claims third-largest globally outside China under CP Plus [Likely] — single-source vendor/analyst framing, https://www.icicidirect.com/mailcontent/idirect_adityainfotech_iporeview-jul_25.pdf

Security context

multiple disclosed CVEs against CP Plus products — CVE-2025-0479 (insecure-cookie info disclosure on a CP Plus router), CVE-2026-6824 (CVSS 8.4, stored XSS in 1xxx-series NVR; CISA advisory ICSA-26-148-05), CVE-2026-9274 (sensitive-info exposure via UART on a Wi-Fi camera series). CP Plus runs a public security-advisory page. [Confirmed] — https://www.cisa.gov/news-events/ics-advisories/icsa-26-148-05 / https://app.opencve.io/cve/?vendor=cp_plus / https://cpplusworld.com/security-advisories

IANA Reference

blank — no IANA RFC reference applies to OUI/MAC vendor entries [Confirmed]

Analyst note

A device presenting 28:18:FD / 5C:35:48 / F8:20:97 is most likely a CP Plus IP camera, NVR, or router. Treat such networked surveillance gear as higher-risk if exposed directly to the internet with default credentials or unpatched firmware.