Search criteria

10 vulnerabilities found for DVR devices by AVTECH

CVE-2025-34066 (GCVE-0-2025-34066)

Vulnerability from cvelistv5 – Published: 2025-07-01 14:47 – Updated: 2025-07-01 18:37
VLAI?
Title
AVTECH IP camera, DVR, and NVR Devices Unauthenticated Information Disclosure
Summary
An improper certificate validation vulnerability exists in AVTECH IP cameras, DVRs, and NVRs due to the use of wget with --no-check-certificate in scripts like SyncCloudAccount.sh and SyncPermit.sh. This exposes HTTPS communications to man-in-the-middle (MITM) attacks.
Severity ?
8.3 (High)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
CWE
  • CWE-295 - Improper Certificate Validation
Assigner
References
Impacted products
Vendor Product Version
AVTECH IP cameras Affected: 0
Create a notification for this product.
Credits
Gergely Eberhardt (SEARCH-LAB.hu)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-34066",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-01T18:37:09.538771Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-01T18:37:36.761Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Cloud sync shell scripts",
            "--no-check-certificate (hardcoded)"
          ],
          "product": "IP cameras",
          "vendor": "AVTECH",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Cloud sync shell scripts",
            "--no-check-certificate (hardcoded)"
          ],
          "product": "DVR devices",
          "vendor": "AVTECH",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Cloud sync shell scripts",
            "--no-check-certificate (hardcoded)"
          ],
          "product": "NVR devices",
          "vendor": "AVTECH",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Gergely Eberhardt (SEARCH-LAB.hu)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An improper certificate validation vulnerability exists in AVTECH IP cameras, DVRs, and NVRs due to the use of wget with --no-check-certificate in scripts like SyncCloudAccount.sh and SyncPermit.sh. This exposes HTTPS communications to man-in-the-middle (MITM) attacks."
            }
          ],
          "value": "An improper certificate validation vulnerability exists in AVTECH IP cameras, DVRs, and NVRs due to the use of wget with --no-check-certificate in scripts like SyncCloudAccount.sh and SyncPermit.sh. This exposes HTTPS communications to man-in-the-middle (MITM) attacks."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-94",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-94 Adversary in the Middle (AiTM)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295 Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-01T14:47:44.573Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "exploit"
          ],
          "url": "https://www.exploit-db.com/exploits/40500"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://avtech.com/"
        },
        {
          "tags": [
            "third-party-advisory",
            "technical-description"
          ],
          "url": "https://web.archive.org/web/20240810225729/https://www.search-lab.hu/advisories/126-AVTech-devices-multiple-vulnerabilities"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://web.archive.org/web/20161029201749/https://github.com/ebux/AVTECH"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "AVTECH IP camera, DVR, and NVR Devices Unauthenticated Information Disclosure",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-34066",
    "datePublished": "2025-07-01T14:47:44.573Z",
    "dateReserved": "2025-04-15T19:15:22.549Z",
    "dateUpdated": "2025-07-01T18:37:36.761Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-34054 (GCVE-0-2025-34054)

Vulnerability from cvelistv5 – Published: 2025-07-01 14:46 – Updated: 2025-11-20 20:51 X_Known Exploited Vulnerability
VLAI?
Title
AVTECH IP camera, DVR, and NVR Devices Unauthenticated Command Injection
Summary
An unauthenticated command injection vulnerability exists in AVTECH DVR devices via Search.cgi?action=cgi_query. The use of wget without input sanitization allows attackers to inject shell commands through the username or queryb64str parameters, executing commands as root. Exploitation evidence was observed by the Shadowserver Foundation on 2025-01-04 UTC.
Severity ?
10 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CWE
  • CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
Impacted products
Vendor Product Version
AVTECH IP camera, DVR, and NVR Devices Affected: 1008-1002-1005-1000
Affected: 1009-1003-1006-1001
Affected: 1009Y-1003Y-1006Y-1001Y
Affected: 1010-1004-1007-1001
Affected: 1011-1005-1008-1002
Affected: 1014-1005-1009-1002
Affected: 1015-1006-1010-1003
Affected: 1016-1007-1011-1003
Affected: 1017-1008-1012-1002
Affected: 1017Y-1008Y-1012Y-1002Y
Affected: 1018-1008-1012-1004
Affected: 1019-1009-1013-1003
Affected: 1019c-1012c-1014c-1001c-FFFF
Affected: 1022-1014-1016-1002-FFFF
Affected: 1022Y-1014Y-1016Y-1002Y-FFFF
Affected: 1023-1014-1017-1002-FFFF
Create a notification for this product.
Credits
Gergely Eberhardt (SEARCH-LAB.hu)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-34054",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-01T18:46:33.820743Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-01T18:46:40.272Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Search.cgi",
            "username parameter",
            "queryb64str"
          ],
          "product": "IP camera, DVR, and NVR Devices",
          "vendor": "AVTECH",
          "versions": [
            {
              "status": "affected",
              "version": "1008-1002-1005-1000"
            },
            {
              "status": "affected",
              "version": "1009-1003-1006-1001"
            },
            {
              "status": "affected",
              "version": "1009Y-1003Y-1006Y-1001Y"
            },
            {
              "status": "affected",
              "version": "1010-1004-1007-1001"
            },
            {
              "status": "affected",
              "version": "1011-1005-1008-1002"
            },
            {
              "status": "affected",
              "version": "1014-1005-1009-1002"
            },
            {
              "status": "affected",
              "version": "1015-1006-1010-1003"
            },
            {
              "status": "affected",
              "version": "1016-1007-1011-1003"
            },
            {
              "status": "affected",
              "version": "1017-1008-1012-1002"
            },
            {
              "status": "affected",
              "version": "1017Y-1008Y-1012Y-1002Y"
            },
            {
              "status": "affected",
              "version": "1018-1008-1012-1004"
            },
            {
              "status": "affected",
              "version": "1019-1009-1013-1003"
            },
            {
              "status": "affected",
              "version": "1019c-1012c-1014c-1001c-FFFF"
            },
            {
              "status": "affected",
              "version": "1022-1014-1016-1002-FFFF"
            },
            {
              "status": "affected",
              "version": "1022Y-1014Y-1016Y-1002Y-FFFF"
            },
            {
              "status": "affected",
              "version": "1023-1014-1017-1002-FFFF"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Gergely Eberhardt (SEARCH-LAB.hu)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An unauthenticated command injection vulnerability exists in AVTECH DVR devices via Search.cgi?action=cgi_query. The use of wget without input sanitization allows attackers to inject shell commands through the username or queryb64str parameters, executing commands as root.\u0026nbsp;Exploitation evidence was observed by the Shadowserver Foundation on 2025-01-04 UTC."
            }
          ],
          "value": "An unauthenticated command injection vulnerability exists in AVTECH DVR devices via Search.cgi?action=cgi_query. The use of wget without input sanitization allows attackers to inject shell commands through the username or queryb64str parameters, executing commands as root.\u00a0Exploitation evidence was observed by the Shadowserver Foundation on 2025-01-04 UTC."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-88",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-88 OS Command Injection"
            }
          ]
        },
        {
          "capecId": "CAPEC-137",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-137 Parameter Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-20T20:51:31.936Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "exploit"
          ],
          "url": "https://www.exploit-db.com/exploits/40500"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://avtech.com/"
        },
        {
          "tags": [
            "third-party-advisory",
            "technical-description"
          ],
          "url": "https://web.archive.org/web/20240810225729/https://www.search-lab.hu/advisories/126-AVTech-devices-multiple-vulnerabilities"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://web.archive.org/web/20161029201749/https://github.com/ebux/AVTECH"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "tags": [
        "x_known-exploited-vulnerability"
      ],
      "title": "AVTECH IP camera, DVR, and NVR Devices Unauthenticated Command Injection",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-34054",
    "datePublished": "2025-07-01T14:46:00.832Z",
    "dateReserved": "2025-04-15T19:15:22.548Z",
    "dateUpdated": "2025-11-20T20:51:31.936Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-34052 (GCVE-0-2025-34052)

Vulnerability from cvelistv5 – Published: 2025-07-01 14:44 – Updated: 2025-10-09 15:06
VLAI?

An unauthenticated endpoint that exposes firmware version, MAC address, and supported codecs is not indicative of a security boundary being crossed, as this metadata is not inherently sensitive and commonly used for legitimate fingerprinting and discovery.

Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2025-10-09T15:06:37.810Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An unauthenticated endpoint that exposes firmware version, MAC address, and supported codecs is not indicative of a security boundary being crossed, as this metadata is not inherently sensitive and commonly used for legitimate fingerprinting and discovery."
            }
          ],
          "value": "An unauthenticated endpoint that exposes firmware version, MAC address, and supported codecs is not indicative of a security boundary being crossed, as this metadata is not inherently sensitive and commonly used for legitimate fingerprinting and discovery."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-34052",
    "datePublished": "2025-07-01T14:44:40.785Z",
    "dateRejected": "2025-10-09T15:03:04.389Z",
    "dateReserved": "2025-04-15T19:15:22.548Z",
    "dateUpdated": "2025-10-09T15:06:37.810Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-34051 (GCVE-0-2025-34051)

Vulnerability from cvelistv5 – Published: 2025-07-01 14:44 – Updated: 2025-07-01 14:59
VLAI?
Title
AVTECH DVR Devices Server-Side Request Forgery
Summary
A server-side request forgery vulnerability exists in multiple firmware versions of AVTECH DVR devices that exposes the /cgi-bin/nobody/Search.cgi?action=cgi_query endpoint without authentication. An attacker can manipulate the ip, port, and queryb64str parameters to make arbitrary HTTP requests from the DVR to internal or external systems, potentially exposing sensitive data or interacting with internal services.
Severity ?
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
  • CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
Impacted products
Vendor Product Version
AVTECH DVR devices Affected: 1001-1000-1000-1000
Affected: 1001-1000-1001-1001
Affected: 1002-1000-1002-1001
Unaffected: 1002-1001-1000-1000
Affected: 1002-1001-1001-1001
Affected: 1004-1002-1001-1000
Affected: 1004-1002-1003-1000-FFFF
Affected: 1004V-1002V-1003V-1001V
Affected: 1004Y-1002Y-1001EJ-1000Y
Affected: 1004Y-1002Y-1001Y-1000Y
Affected: 1005-1002-1002-1000
Affected: 1005-1002-1004-1001
Affected: 1006-1001-1003-1004
Affected: 1006-1002-1003-1000
Affected: 1006Y-1002Y-1003Y-1000Y
Affected: 1007-1002-1004-1000
Affected: 1007-1003-1003-1002
Affected: 1007-1003-1005-1001
Affected: 1007E-1003E-1005EJ-1001E
Affected: 1007V-1003V-1005V-1001V
Affected: 1007Y-1002Y-1004Y-1000Y
Affected: 1008-1002-1005-1000
Affected: 1008-1004-1003-1002
Affected: 1009-1003-1005-1006
Affected: 1009-1003-1006-1001
Affected: 1009-1007-1007-1000-FFFF
Affected: 1009Y-1003Y-1006Y-1001Y
Affected: 1010-1004-1007-1001
Affected: 1010-1005-1005-1002
Affected: 1011-1004-1005-1006
Affected: 1011-1005-1007-1001
Affected: 1011-1005-1007EJ-1001
Affected: 1011-1005-1008-1002
Affected: 1012-1004-1005-1006
Affected: 1012-1005-1007-1002
Affected: 1012-1006-1007-1001
Affected: 1012-1008-1009-1000-FFFF
Affected: 1014-1005-1009-1002
Affected: 1014-1007-1009-1001
Affected: 1014-1010-1010-1000-FFFF
Affected: 1014Y-1007Y-1009Y-1001Y
Affected: 1015-1006-1010-1003
Affected: 1015-1007-1007-1007
Affected: 1015-1007-1010-1001
Affected: 1015-1010-1011-1000-FFFF
Affected: 1015Y-1007Y-1010Y-1001Y
Affected: 1016-1007-1005-1001
Affected: 1016-1007-1011-1001
Affected: 1016-1007-1011-1003
Affected: 1016-1008-1007-1007
Affected: 1016Y-1007Y-1011Y-1001Y
Affected: 1017-1008-1012-1002
Affected: 1017-1009-1008-1008
Affected: 1017-1011-1013-1001-FFFF
Affected: 1017f-1011f-1013f-1001f-FFFF
Affected: 1017Y-1008Y-1012Y-1002Y
Affected: 1018-1008-1012-1004
Affected: 1019-1009-1013-1003
Affected: 1019-1010-1009-1009
Affected: 1019c-1012c-1014c-1001c-FFFF
Affected: 1021-1011-1010-1009
Affected: 1022-1012-1011-1009
Affected: 1022-1014-1016-1002-FFFF
Affected: 1022Y-1014Y-1016Y-1002Y-FFFF
Affected: 1023-1013-1011-1009
Affected: 1023-1014-1017-1002-FFFF
Affected: 1025-1014-1013-1009
Affected: 1026-1014-1014-1009
Affected: 1027-1014-1015-1009
Affected: S968-S968-S968-S968
Affected: V171P-V171P-V171P-V171P
Affected: V189-V189-V189-V189
Create a notification for this product.
Credits
Gergely Eberhardt (SEARCH-LAB.hu)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-34051",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-01T14:57:37.177556Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-01T14:59:04.311Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Search.cgi endpoint",
            "ip parameter",
            "port parameter",
            "queryb64str parameter"
          ],
          "product": "DVR devices",
          "vendor": "AVTECH",
          "versions": [
            {
              "status": "affected",
              "version": "1001-1000-1000-1000"
            },
            {
              "status": "affected",
              "version": "1001-1000-1001-1001"
            },
            {
              "status": "affected",
              "version": "1002-1000-1002-1001"
            },
            {
              "status": "unaffected",
              "version": "1002-1001-1000-1000"
            },
            {
              "status": "affected",
              "version": "1002-1001-1001-1001"
            },
            {
              "status": "affected",
              "version": "1004-1002-1001-1000"
            },
            {
              "status": "affected",
              "version": "1004-1002-1003-1000-FFFF"
            },
            {
              "status": "affected",
              "version": "1004V-1002V-1003V-1001V"
            },
            {
              "status": "affected",
              "version": "1004Y-1002Y-1001EJ-1000Y"
            },
            {
              "status": "affected",
              "version": "1004Y-1002Y-1001Y-1000Y"
            },
            {
              "status": "affected",
              "version": "1005-1002-1002-1000"
            },
            {
              "status": "affected",
              "version": "1005-1002-1004-1001"
            },
            {
              "status": "affected",
              "version": "1006-1001-1003-1004"
            },
            {
              "status": "affected",
              "version": "1006-1002-1003-1000"
            },
            {
              "status": "affected",
              "version": "1006Y-1002Y-1003Y-1000Y"
            },
            {
              "status": "affected",
              "version": "1007-1002-1004-1000"
            },
            {
              "status": "affected",
              "version": "1007-1003-1003-1002"
            },
            {
              "status": "affected",
              "version": "1007-1003-1005-1001"
            },
            {
              "status": "affected",
              "version": "1007E-1003E-1005EJ-1001E"
            },
            {
              "status": "affected",
              "version": "1007V-1003V-1005V-1001V"
            },
            {
              "status": "affected",
              "version": "1007Y-1002Y-1004Y-1000Y"
            },
            {
              "status": "affected",
              "version": "1008-1002-1005-1000"
            },
            {
              "status": "affected",
              "version": "1008-1004-1003-1002"
            },
            {
              "status": "affected",
              "version": "1009-1003-1005-1006"
            },
            {
              "status": "affected",
              "version": "1009-1003-1006-1001"
            },
            {
              "status": "affected",
              "version": "1009-1007-1007-1000-FFFF"
            },
            {
              "status": "affected",
              "version": "1009Y-1003Y-1006Y-1001Y"
            },
            {
              "status": "affected",
              "version": "1010-1004-1007-1001"
            },
            {
              "status": "affected",
              "version": "1010-1005-1005-1002"
            },
            {
              "status": "affected",
              "version": "1011-1004-1005-1006"
            },
            {
              "status": "affected",
              "version": "1011-1005-1007-1001"
            },
            {
              "status": "affected",
              "version": "1011-1005-1007EJ-1001"
            },
            {
              "status": "affected",
              "version": "1011-1005-1008-1002"
            },
            {
              "status": "affected",
              "version": "1012-1004-1005-1006"
            },
            {
              "status": "affected",
              "version": "1012-1005-1007-1002"
            },
            {
              "status": "affected",
              "version": "1012-1006-1007-1001"
            },
            {
              "status": "affected",
              "version": "1012-1008-1009-1000-FFFF"
            },
            {
              "status": "affected",
              "version": "1014-1005-1009-1002"
            },
            {
              "status": "affected",
              "version": "1014-1007-1009-1001"
            },
            {
              "status": "affected",
              "version": "1014-1010-1010-1000-FFFF"
            },
            {
              "status": "affected",
              "version": "1014Y-1007Y-1009Y-1001Y"
            },
            {
              "status": "affected",
              "version": "1015-1006-1010-1003"
            },
            {
              "status": "affected",
              "version": "1015-1007-1007-1007"
            },
            {
              "status": "affected",
              "version": "1015-1007-1010-1001"
            },
            {
              "status": "affected",
              "version": "1015-1010-1011-1000-FFFF"
            },
            {
              "status": "affected",
              "version": "1015Y-1007Y-1010Y-1001Y"
            },
            {
              "status": "affected",
              "version": "1016-1007-1005-1001"
            },
            {
              "status": "affected",
              "version": "1016-1007-1011-1001"
            },
            {
              "status": "affected",
              "version": "1016-1007-1011-1003"
            },
            {
              "status": "affected",
              "version": "1016-1008-1007-1007"
            },
            {
              "status": "affected",
              "version": "1016Y-1007Y-1011Y-1001Y"
            },
            {
              "status": "affected",
              "version": "1017-1008-1012-1002"
            },
            {
              "status": "affected",
              "version": "1017-1009-1008-1008"
            },
            {
              "status": "affected",
              "version": "1017-1011-1013-1001-FFFF"
            },
            {
              "status": "affected",
              "version": "1017f-1011f-1013f-1001f-FFFF"
            },
            {
              "status": "affected",
              "version": "1017Y-1008Y-1012Y-1002Y"
            },
            {
              "status": "affected",
              "version": "1018-1008-1012-1004"
            },
            {
              "status": "affected",
              "version": "1019-1009-1013-1003"
            },
            {
              "status": "affected",
              "version": "1019-1010-1009-1009"
            },
            {
              "status": "affected",
              "version": "1019c-1012c-1014c-1001c-FFFF"
            },
            {
              "status": "affected",
              "version": "1021-1011-1010-1009"
            },
            {
              "status": "affected",
              "version": "1022-1012-1011-1009"
            },
            {
              "status": "affected",
              "version": "1022-1014-1016-1002-FFFF"
            },
            {
              "status": "affected",
              "version": "1022Y-1014Y-1016Y-1002Y-FFFF"
            },
            {
              "status": "affected",
              "version": "1023-1013-1011-1009"
            },
            {
              "status": "affected",
              "version": "1023-1014-1017-1002-FFFF"
            },
            {
              "status": "affected",
              "version": "1025-1014-1013-1009"
            },
            {
              "status": "affected",
              "version": "1026-1014-1014-1009"
            },
            {
              "status": "affected",
              "version": "1027-1014-1015-1009"
            },
            {
              "status": "affected",
              "version": "S968-S968-S968-S968"
            },
            {
              "status": "affected",
              "version": "V171P-V171P-V171P-V171P"
            },
            {
              "status": "affected",
              "version": "V189-V189-V189-V189"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Gergely Eberhardt (SEARCH-LAB.hu)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A server-side request forgery vulnerability exists in multiple firmware versions of AVTECH DVR devices that exposes the \u003ccode\u003e/cgi-bin/nobody/Search.cgi?action=cgi_query\u003c/code\u003e endpoint without authentication. An attacker can manipulate the \u003ccode\u003eip\u003c/code\u003e, \u003ccode\u003eport\u003c/code\u003e, and \u003ccode\u003equeryb64str\u003c/code\u003e parameters to make arbitrary HTTP requests from the DVR to internal or external systems, potentially exposing sensitive data or interacting with internal services."
            }
          ],
          "value": "A server-side request forgery vulnerability exists in multiple firmware versions of AVTECH DVR devices that exposes the /cgi-bin/nobody/Search.cgi?action=cgi_query endpoint without authentication. An attacker can manipulate the ip, port, and queryb64str parameters to make arbitrary HTTP requests from the DVR to internal or external systems, potentially exposing sensitive data or interacting with internal services."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-664",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-664 Server Side Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-01T14:44:22.913Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "exploit"
          ],
          "url": "https://www.exploit-db.com/exploits/40500"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://avtech.com/"
        },
        {
          "tags": [
            "third-party-advisory",
            "technical-description"
          ],
          "url": "https://web.archive.org/web/20240810225729/https://www.search-lab.hu/advisories/126-AVTech-devices-multiple-vulnerabilities"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://web.archive.org/web/20161029201749/https://github.com/ebux/AVTECH"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "AVTECH DVR Devices Server-Side Request Forgery",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-34051",
    "datePublished": "2025-07-01T14:44:22.913Z",
    "dateReserved": "2025-04-15T19:15:22.548Z",
    "dateUpdated": "2025-07-01T14:59:04.311Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-34050 (GCVE-0-2025-34050)

Vulnerability from cvelistv5 – Published: 2025-07-01 14:42 – Updated: 2025-07-01 18:45
VLAI?
Title
AVTECH IP Camera, DVR, and NVR Devices Cross-Site Request Forgery
Summary
A cross-site request forgery (CSRF) vulnerability exists in the web interface of AVTECH IP camera, DVR, and NVR devices. An attacker can craft malicious requests that, when executed in the context of an authenticated user’s browser session, allow unauthorized changes to the device configuration without user interaction.
Severity ?
5.1 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CWE
  • CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
Impacted products
Vendor Product Version
AVTECH IP cameras Affected: 0
Create a notification for this product.
Credits
Gergely Eberhardt (SEARCH-LAB.hu)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-34050",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-01T18:44:55.395830Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-01T18:45:06.703Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Web Management Interface (configuration endpoints)"
          ],
          "product": "IP cameras",
          "vendor": "AVTECH",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Web Management Interface (configuration endpoints)"
          ],
          "product": "DVR devices",
          "vendor": "AVTECH",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Web Management Interface (configuration endpoints)"
          ],
          "product": "NVR devices",
          "vendor": "AVTECH",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Gergely Eberhardt (SEARCH-LAB.hu)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A\u0026nbsp;cross-site request forgery (CSRF) vulnerability exists in the web interface of AVTECH IP camera, DVR, and NVR devices. An attacker can craft malicious requests that, when executed in the context of an authenticated user\u2019s browser session, allow unauthorized changes to the device configuration without user interaction."
            }
          ],
          "value": "A\u00a0cross-site request forgery (CSRF) vulnerability exists in the web interface of AVTECH IP camera, DVR, and NVR devices. An attacker can craft malicious requests that, when executed in the context of an authenticated user\u2019s browser session, allow unauthorized changes to the device configuration without user interaction."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-62",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-62 Cross Site Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-01T14:42:57.143Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "exploit"
          ],
          "url": "https://www.exploit-db.com/exploits/40500"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://avtech.com/"
        },
        {
          "tags": [
            "third-party-advisory",
            "technical-description"
          ],
          "url": "https://web.archive.org/web/20240810225729/https://www.search-lab.hu/advisories/126-AVTech-devices-multiple-vulnerabilities"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://web.archive.org/web/20161029201749/https://github.com/ebux/AVTECH"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "AVTECH IP Camera, DVR, and NVR Devices Cross-Site Request Forgery",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-34050",
    "datePublished": "2025-07-01T14:42:57.143Z",
    "dateReserved": "2025-04-15T19:15:22.548Z",
    "dateUpdated": "2025-07-01T18:45:06.703Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-34066 (GCVE-0-2025-34066)

Vulnerability from nvd – Published: 2025-07-01 14:47 – Updated: 2025-07-01 18:37
VLAI?
Title
AVTECH IP camera, DVR, and NVR Devices Unauthenticated Information Disclosure
Summary
An improper certificate validation vulnerability exists in AVTECH IP cameras, DVRs, and NVRs due to the use of wget with --no-check-certificate in scripts like SyncCloudAccount.sh and SyncPermit.sh. This exposes HTTPS communications to man-in-the-middle (MITM) attacks.
Severity ?
8.3 (High)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
CWE
  • CWE-295 - Improper Certificate Validation
Assigner
References
Impacted products
Vendor Product Version
AVTECH IP cameras Affected: 0
Create a notification for this product.
Credits
Gergely Eberhardt (SEARCH-LAB.hu)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-34066",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-01T18:37:09.538771Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-01T18:37:36.761Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Cloud sync shell scripts",
            "--no-check-certificate (hardcoded)"
          ],
          "product": "IP cameras",
          "vendor": "AVTECH",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Cloud sync shell scripts",
            "--no-check-certificate (hardcoded)"
          ],
          "product": "DVR devices",
          "vendor": "AVTECH",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Cloud sync shell scripts",
            "--no-check-certificate (hardcoded)"
          ],
          "product": "NVR devices",
          "vendor": "AVTECH",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Gergely Eberhardt (SEARCH-LAB.hu)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An improper certificate validation vulnerability exists in AVTECH IP cameras, DVRs, and NVRs due to the use of wget with --no-check-certificate in scripts like SyncCloudAccount.sh and SyncPermit.sh. This exposes HTTPS communications to man-in-the-middle (MITM) attacks."
            }
          ],
          "value": "An improper certificate validation vulnerability exists in AVTECH IP cameras, DVRs, and NVRs due to the use of wget with --no-check-certificate in scripts like SyncCloudAccount.sh and SyncPermit.sh. This exposes HTTPS communications to man-in-the-middle (MITM) attacks."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-94",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-94 Adversary in the Middle (AiTM)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295 Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-01T14:47:44.573Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "exploit"
          ],
          "url": "https://www.exploit-db.com/exploits/40500"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://avtech.com/"
        },
        {
          "tags": [
            "third-party-advisory",
            "technical-description"
          ],
          "url": "https://web.archive.org/web/20240810225729/https://www.search-lab.hu/advisories/126-AVTech-devices-multiple-vulnerabilities"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://web.archive.org/web/20161029201749/https://github.com/ebux/AVTECH"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "AVTECH IP camera, DVR, and NVR Devices Unauthenticated Information Disclosure",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-34066",
    "datePublished": "2025-07-01T14:47:44.573Z",
    "dateReserved": "2025-04-15T19:15:22.549Z",
    "dateUpdated": "2025-07-01T18:37:36.761Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-34054 (GCVE-0-2025-34054)

Vulnerability from nvd – Published: 2025-07-01 14:46 – Updated: 2025-11-20 20:51 X_Known Exploited Vulnerability
VLAI?
Title
AVTECH IP camera, DVR, and NVR Devices Unauthenticated Command Injection
Summary
An unauthenticated command injection vulnerability exists in AVTECH DVR devices via Search.cgi?action=cgi_query. The use of wget without input sanitization allows attackers to inject shell commands through the username or queryb64str parameters, executing commands as root. Exploitation evidence was observed by the Shadowserver Foundation on 2025-01-04 UTC.
Severity ?
10 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CWE
  • CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
Impacted products
Vendor Product Version
AVTECH IP camera, DVR, and NVR Devices Affected: 1008-1002-1005-1000
Affected: 1009-1003-1006-1001
Affected: 1009Y-1003Y-1006Y-1001Y
Affected: 1010-1004-1007-1001
Affected: 1011-1005-1008-1002
Affected: 1014-1005-1009-1002
Affected: 1015-1006-1010-1003
Affected: 1016-1007-1011-1003
Affected: 1017-1008-1012-1002
Affected: 1017Y-1008Y-1012Y-1002Y
Affected: 1018-1008-1012-1004
Affected: 1019-1009-1013-1003
Affected: 1019c-1012c-1014c-1001c-FFFF
Affected: 1022-1014-1016-1002-FFFF
Affected: 1022Y-1014Y-1016Y-1002Y-FFFF
Affected: 1023-1014-1017-1002-FFFF
Create a notification for this product.
Credits
Gergely Eberhardt (SEARCH-LAB.hu)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-34054",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-01T18:46:33.820743Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-01T18:46:40.272Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Search.cgi",
            "username parameter",
            "queryb64str"
          ],
          "product": "IP camera, DVR, and NVR Devices",
          "vendor": "AVTECH",
          "versions": [
            {
              "status": "affected",
              "version": "1008-1002-1005-1000"
            },
            {
              "status": "affected",
              "version": "1009-1003-1006-1001"
            },
            {
              "status": "affected",
              "version": "1009Y-1003Y-1006Y-1001Y"
            },
            {
              "status": "affected",
              "version": "1010-1004-1007-1001"
            },
            {
              "status": "affected",
              "version": "1011-1005-1008-1002"
            },
            {
              "status": "affected",
              "version": "1014-1005-1009-1002"
            },
            {
              "status": "affected",
              "version": "1015-1006-1010-1003"
            },
            {
              "status": "affected",
              "version": "1016-1007-1011-1003"
            },
            {
              "status": "affected",
              "version": "1017-1008-1012-1002"
            },
            {
              "status": "affected",
              "version": "1017Y-1008Y-1012Y-1002Y"
            },
            {
              "status": "affected",
              "version": "1018-1008-1012-1004"
            },
            {
              "status": "affected",
              "version": "1019-1009-1013-1003"
            },
            {
              "status": "affected",
              "version": "1019c-1012c-1014c-1001c-FFFF"
            },
            {
              "status": "affected",
              "version": "1022-1014-1016-1002-FFFF"
            },
            {
              "status": "affected",
              "version": "1022Y-1014Y-1016Y-1002Y-FFFF"
            },
            {
              "status": "affected",
              "version": "1023-1014-1017-1002-FFFF"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Gergely Eberhardt (SEARCH-LAB.hu)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An unauthenticated command injection vulnerability exists in AVTECH DVR devices via Search.cgi?action=cgi_query. The use of wget without input sanitization allows attackers to inject shell commands through the username or queryb64str parameters, executing commands as root.\u0026nbsp;Exploitation evidence was observed by the Shadowserver Foundation on 2025-01-04 UTC."
            }
          ],
          "value": "An unauthenticated command injection vulnerability exists in AVTECH DVR devices via Search.cgi?action=cgi_query. The use of wget without input sanitization allows attackers to inject shell commands through the username or queryb64str parameters, executing commands as root.\u00a0Exploitation evidence was observed by the Shadowserver Foundation on 2025-01-04 UTC."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-88",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-88 OS Command Injection"
            }
          ]
        },
        {
          "capecId": "CAPEC-137",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-137 Parameter Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-20T20:51:31.936Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "exploit"
          ],
          "url": "https://www.exploit-db.com/exploits/40500"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://avtech.com/"
        },
        {
          "tags": [
            "third-party-advisory",
            "technical-description"
          ],
          "url": "https://web.archive.org/web/20240810225729/https://www.search-lab.hu/advisories/126-AVTech-devices-multiple-vulnerabilities"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://web.archive.org/web/20161029201749/https://github.com/ebux/AVTECH"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "tags": [
        "x_known-exploited-vulnerability"
      ],
      "title": "AVTECH IP camera, DVR, and NVR Devices Unauthenticated Command Injection",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-34054",
    "datePublished": "2025-07-01T14:46:00.832Z",
    "dateReserved": "2025-04-15T19:15:22.548Z",
    "dateUpdated": "2025-11-20T20:51:31.936Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-34052 (GCVE-0-2025-34052)

Vulnerability from nvd – Published: 2025-07-01 14:44 – Updated: 2025-10-09 15:06
VLAI?

An unauthenticated endpoint that exposes firmware version, MAC address, and supported codecs is not indicative of a security boundary being crossed, as this metadata is not inherently sensitive and commonly used for legitimate fingerprinting and discovery.

Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2025-10-09T15:06:37.810Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An unauthenticated endpoint that exposes firmware version, MAC address, and supported codecs is not indicative of a security boundary being crossed, as this metadata is not inherently sensitive and commonly used for legitimate fingerprinting and discovery."
            }
          ],
          "value": "An unauthenticated endpoint that exposes firmware version, MAC address, and supported codecs is not indicative of a security boundary being crossed, as this metadata is not inherently sensitive and commonly used for legitimate fingerprinting and discovery."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-34052",
    "datePublished": "2025-07-01T14:44:40.785Z",
    "dateRejected": "2025-10-09T15:03:04.389Z",
    "dateReserved": "2025-04-15T19:15:22.548Z",
    "dateUpdated": "2025-10-09T15:06:37.810Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-34051 (GCVE-0-2025-34051)

Vulnerability from nvd – Published: 2025-07-01 14:44 – Updated: 2025-07-01 14:59
VLAI?
Title
AVTECH DVR Devices Server-Side Request Forgery
Summary
A server-side request forgery vulnerability exists in multiple firmware versions of AVTECH DVR devices that exposes the /cgi-bin/nobody/Search.cgi?action=cgi_query endpoint without authentication. An attacker can manipulate the ip, port, and queryb64str parameters to make arbitrary HTTP requests from the DVR to internal or external systems, potentially exposing sensitive data or interacting with internal services.
Severity ?
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
  • CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
Impacted products
Vendor Product Version
AVTECH DVR devices Affected: 1001-1000-1000-1000
Affected: 1001-1000-1001-1001
Affected: 1002-1000-1002-1001
Unaffected: 1002-1001-1000-1000
Affected: 1002-1001-1001-1001
Affected: 1004-1002-1001-1000
Affected: 1004-1002-1003-1000-FFFF
Affected: 1004V-1002V-1003V-1001V
Affected: 1004Y-1002Y-1001EJ-1000Y
Affected: 1004Y-1002Y-1001Y-1000Y
Affected: 1005-1002-1002-1000
Affected: 1005-1002-1004-1001
Affected: 1006-1001-1003-1004
Affected: 1006-1002-1003-1000
Affected: 1006Y-1002Y-1003Y-1000Y
Affected: 1007-1002-1004-1000
Affected: 1007-1003-1003-1002
Affected: 1007-1003-1005-1001
Affected: 1007E-1003E-1005EJ-1001E
Affected: 1007V-1003V-1005V-1001V
Affected: 1007Y-1002Y-1004Y-1000Y
Affected: 1008-1002-1005-1000
Affected: 1008-1004-1003-1002
Affected: 1009-1003-1005-1006
Affected: 1009-1003-1006-1001
Affected: 1009-1007-1007-1000-FFFF
Affected: 1009Y-1003Y-1006Y-1001Y
Affected: 1010-1004-1007-1001
Affected: 1010-1005-1005-1002
Affected: 1011-1004-1005-1006
Affected: 1011-1005-1007-1001
Affected: 1011-1005-1007EJ-1001
Affected: 1011-1005-1008-1002
Affected: 1012-1004-1005-1006
Affected: 1012-1005-1007-1002
Affected: 1012-1006-1007-1001
Affected: 1012-1008-1009-1000-FFFF
Affected: 1014-1005-1009-1002
Affected: 1014-1007-1009-1001
Affected: 1014-1010-1010-1000-FFFF
Affected: 1014Y-1007Y-1009Y-1001Y
Affected: 1015-1006-1010-1003
Affected: 1015-1007-1007-1007
Affected: 1015-1007-1010-1001
Affected: 1015-1010-1011-1000-FFFF
Affected: 1015Y-1007Y-1010Y-1001Y
Affected: 1016-1007-1005-1001
Affected: 1016-1007-1011-1001
Affected: 1016-1007-1011-1003
Affected: 1016-1008-1007-1007
Affected: 1016Y-1007Y-1011Y-1001Y
Affected: 1017-1008-1012-1002
Affected: 1017-1009-1008-1008
Affected: 1017-1011-1013-1001-FFFF
Affected: 1017f-1011f-1013f-1001f-FFFF
Affected: 1017Y-1008Y-1012Y-1002Y
Affected: 1018-1008-1012-1004
Affected: 1019-1009-1013-1003
Affected: 1019-1010-1009-1009
Affected: 1019c-1012c-1014c-1001c-FFFF
Affected: 1021-1011-1010-1009
Affected: 1022-1012-1011-1009
Affected: 1022-1014-1016-1002-FFFF
Affected: 1022Y-1014Y-1016Y-1002Y-FFFF
Affected: 1023-1013-1011-1009
Affected: 1023-1014-1017-1002-FFFF
Affected: 1025-1014-1013-1009
Affected: 1026-1014-1014-1009
Affected: 1027-1014-1015-1009
Affected: S968-S968-S968-S968
Affected: V171P-V171P-V171P-V171P
Affected: V189-V189-V189-V189
Create a notification for this product.
Credits
Gergely Eberhardt (SEARCH-LAB.hu)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-34051",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-01T14:57:37.177556Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-01T14:59:04.311Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Search.cgi endpoint",
            "ip parameter",
            "port parameter",
            "queryb64str parameter"
          ],
          "product": "DVR devices",
          "vendor": "AVTECH",
          "versions": [
            {
              "status": "affected",
              "version": "1001-1000-1000-1000"
            },
            {
              "status": "affected",
              "version": "1001-1000-1001-1001"
            },
            {
              "status": "affected",
              "version": "1002-1000-1002-1001"
            },
            {
              "status": "unaffected",
              "version": "1002-1001-1000-1000"
            },
            {
              "status": "affected",
              "version": "1002-1001-1001-1001"
            },
            {
              "status": "affected",
              "version": "1004-1002-1001-1000"
            },
            {
              "status": "affected",
              "version": "1004-1002-1003-1000-FFFF"
            },
            {
              "status": "affected",
              "version": "1004V-1002V-1003V-1001V"
            },
            {
              "status": "affected",
              "version": "1004Y-1002Y-1001EJ-1000Y"
            },
            {
              "status": "affected",
              "version": "1004Y-1002Y-1001Y-1000Y"
            },
            {
              "status": "affected",
              "version": "1005-1002-1002-1000"
            },
            {
              "status": "affected",
              "version": "1005-1002-1004-1001"
            },
            {
              "status": "affected",
              "version": "1006-1001-1003-1004"
            },
            {
              "status": "affected",
              "version": "1006-1002-1003-1000"
            },
            {
              "status": "affected",
              "version": "1006Y-1002Y-1003Y-1000Y"
            },
            {
              "status": "affected",
              "version": "1007-1002-1004-1000"
            },
            {
              "status": "affected",
              "version": "1007-1003-1003-1002"
            },
            {
              "status": "affected",
              "version": "1007-1003-1005-1001"
            },
            {
              "status": "affected",
              "version": "1007E-1003E-1005EJ-1001E"
            },
            {
              "status": "affected",
              "version": "1007V-1003V-1005V-1001V"
            },
            {
              "status": "affected",
              "version": "1007Y-1002Y-1004Y-1000Y"
            },
            {
              "status": "affected",
              "version": "1008-1002-1005-1000"
            },
            {
              "status": "affected",
              "version": "1008-1004-1003-1002"
            },
            {
              "status": "affected",
              "version": "1009-1003-1005-1006"
            },
            {
              "status": "affected",
              "version": "1009-1003-1006-1001"
            },
            {
              "status": "affected",
              "version": "1009-1007-1007-1000-FFFF"
            },
            {
              "status": "affected",
              "version": "1009Y-1003Y-1006Y-1001Y"
            },
            {
              "status": "affected",
              "version": "1010-1004-1007-1001"
            },
            {
              "status": "affected",
              "version": "1010-1005-1005-1002"
            },
            {
              "status": "affected",
              "version": "1011-1004-1005-1006"
            },
            {
              "status": "affected",
              "version": "1011-1005-1007-1001"
            },
            {
              "status": "affected",
              "version": "1011-1005-1007EJ-1001"
            },
            {
              "status": "affected",
              "version": "1011-1005-1008-1002"
            },
            {
              "status": "affected",
              "version": "1012-1004-1005-1006"
            },
            {
              "status": "affected",
              "version": "1012-1005-1007-1002"
            },
            {
              "status": "affected",
              "version": "1012-1006-1007-1001"
            },
            {
              "status": "affected",
              "version": "1012-1008-1009-1000-FFFF"
            },
            {
              "status": "affected",
              "version": "1014-1005-1009-1002"
            },
            {
              "status": "affected",
              "version": "1014-1007-1009-1001"
            },
            {
              "status": "affected",
              "version": "1014-1010-1010-1000-FFFF"
            },
            {
              "status": "affected",
              "version": "1014Y-1007Y-1009Y-1001Y"
            },
            {
              "status": "affected",
              "version": "1015-1006-1010-1003"
            },
            {
              "status": "affected",
              "version": "1015-1007-1007-1007"
            },
            {
              "status": "affected",
              "version": "1015-1007-1010-1001"
            },
            {
              "status": "affected",
              "version": "1015-1010-1011-1000-FFFF"
            },
            {
              "status": "affected",
              "version": "1015Y-1007Y-1010Y-1001Y"
            },
            {
              "status": "affected",
              "version": "1016-1007-1005-1001"
            },
            {
              "status": "affected",
              "version": "1016-1007-1011-1001"
            },
            {
              "status": "affected",
              "version": "1016-1007-1011-1003"
            },
            {
              "status": "affected",
              "version": "1016-1008-1007-1007"
            },
            {
              "status": "affected",
              "version": "1016Y-1007Y-1011Y-1001Y"
            },
            {
              "status": "affected",
              "version": "1017-1008-1012-1002"
            },
            {
              "status": "affected",
              "version": "1017-1009-1008-1008"
            },
            {
              "status": "affected",
              "version": "1017-1011-1013-1001-FFFF"
            },
            {
              "status": "affected",
              "version": "1017f-1011f-1013f-1001f-FFFF"
            },
            {
              "status": "affected",
              "version": "1017Y-1008Y-1012Y-1002Y"
            },
            {
              "status": "affected",
              "version": "1018-1008-1012-1004"
            },
            {
              "status": "affected",
              "version": "1019-1009-1013-1003"
            },
            {
              "status": "affected",
              "version": "1019-1010-1009-1009"
            },
            {
              "status": "affected",
              "version": "1019c-1012c-1014c-1001c-FFFF"
            },
            {
              "status": "affected",
              "version": "1021-1011-1010-1009"
            },
            {
              "status": "affected",
              "version": "1022-1012-1011-1009"
            },
            {
              "status": "affected",
              "version": "1022-1014-1016-1002-FFFF"
            },
            {
              "status": "affected",
              "version": "1022Y-1014Y-1016Y-1002Y-FFFF"
            },
            {
              "status": "affected",
              "version": "1023-1013-1011-1009"
            },
            {
              "status": "affected",
              "version": "1023-1014-1017-1002-FFFF"
            },
            {
              "status": "affected",
              "version": "1025-1014-1013-1009"
            },
            {
              "status": "affected",
              "version": "1026-1014-1014-1009"
            },
            {
              "status": "affected",
              "version": "1027-1014-1015-1009"
            },
            {
              "status": "affected",
              "version": "S968-S968-S968-S968"
            },
            {
              "status": "affected",
              "version": "V171P-V171P-V171P-V171P"
            },
            {
              "status": "affected",
              "version": "V189-V189-V189-V189"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Gergely Eberhardt (SEARCH-LAB.hu)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A server-side request forgery vulnerability exists in multiple firmware versions of AVTECH DVR devices that exposes the \u003ccode\u003e/cgi-bin/nobody/Search.cgi?action=cgi_query\u003c/code\u003e endpoint without authentication. An attacker can manipulate the \u003ccode\u003eip\u003c/code\u003e, \u003ccode\u003eport\u003c/code\u003e, and \u003ccode\u003equeryb64str\u003c/code\u003e parameters to make arbitrary HTTP requests from the DVR to internal or external systems, potentially exposing sensitive data or interacting with internal services."
            }
          ],
          "value": "A server-side request forgery vulnerability exists in multiple firmware versions of AVTECH DVR devices that exposes the /cgi-bin/nobody/Search.cgi?action=cgi_query endpoint without authentication. An attacker can manipulate the ip, port, and queryb64str parameters to make arbitrary HTTP requests from the DVR to internal or external systems, potentially exposing sensitive data or interacting with internal services."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-664",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-664 Server Side Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-01T14:44:22.913Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "exploit"
          ],
          "url": "https://www.exploit-db.com/exploits/40500"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://avtech.com/"
        },
        {
          "tags": [
            "third-party-advisory",
            "technical-description"
          ],
          "url": "https://web.archive.org/web/20240810225729/https://www.search-lab.hu/advisories/126-AVTech-devices-multiple-vulnerabilities"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://web.archive.org/web/20161029201749/https://github.com/ebux/AVTECH"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "AVTECH DVR Devices Server-Side Request Forgery",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-34051",
    "datePublished": "2025-07-01T14:44:22.913Z",
    "dateReserved": "2025-04-15T19:15:22.548Z",
    "dateUpdated": "2025-07-01T14:59:04.311Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-34050 (GCVE-0-2025-34050)

Vulnerability from nvd – Published: 2025-07-01 14:42 – Updated: 2025-07-01 18:45
VLAI?
Title
AVTECH IP Camera, DVR, and NVR Devices Cross-Site Request Forgery
Summary
A cross-site request forgery (CSRF) vulnerability exists in the web interface of AVTECH IP camera, DVR, and NVR devices. An attacker can craft malicious requests that, when executed in the context of an authenticated user’s browser session, allow unauthorized changes to the device configuration without user interaction.
Severity ?
5.1 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CWE
  • CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
Impacted products
Vendor Product Version
AVTECH IP cameras Affected: 0
Create a notification for this product.
Credits
Gergely Eberhardt (SEARCH-LAB.hu)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-34050",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-01T18:44:55.395830Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-01T18:45:06.703Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Web Management Interface (configuration endpoints)"
          ],
          "product": "IP cameras",
          "vendor": "AVTECH",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Web Management Interface (configuration endpoints)"
          ],
          "product": "DVR devices",
          "vendor": "AVTECH",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Web Management Interface (configuration endpoints)"
          ],
          "product": "NVR devices",
          "vendor": "AVTECH",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Gergely Eberhardt (SEARCH-LAB.hu)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A\u0026nbsp;cross-site request forgery (CSRF) vulnerability exists in the web interface of AVTECH IP camera, DVR, and NVR devices. An attacker can craft malicious requests that, when executed in the context of an authenticated user\u2019s browser session, allow unauthorized changes to the device configuration without user interaction."
            }
          ],
          "value": "A\u00a0cross-site request forgery (CSRF) vulnerability exists in the web interface of AVTECH IP camera, DVR, and NVR devices. An attacker can craft malicious requests that, when executed in the context of an authenticated user\u2019s browser session, allow unauthorized changes to the device configuration without user interaction."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-62",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-62 Cross Site Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-01T14:42:57.143Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "exploit"
          ],
          "url": "https://www.exploit-db.com/exploits/40500"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://avtech.com/"
        },
        {
          "tags": [
            "third-party-advisory",
            "technical-description"
          ],
          "url": "https://web.archive.org/web/20240810225729/https://www.search-lab.hu/advisories/126-AVTech-devices-multiple-vulnerabilities"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://web.archive.org/web/20161029201749/https://github.com/ebux/AVTECH"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "AVTECH IP Camera, DVR, and NVR Devices Cross-Site Request Forgery",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-34050",
    "datePublished": "2025-07-01T14:42:57.143Z",
    "dateReserved": "2025-04-15T19:15:22.548Z",
    "dateUpdated": "2025-07-01T18:45:06.703Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}