by Kastro CVE-2025-34054
AVTECH IP camera, DVR, and NVR Devices — AVTECH IP camera, DVR, and NVR Devices Unauthenticated Command Injection
Description · from the CVE record
An unauthenticated command injection vulnerability exists in AVTECH DVR devices via Search.cgi?action=cgi_query. The use of wget without input sanitization allows attackers to inject shell commands through the username or queryb64str parameters, executing commands as root. Exploitation evidence was observed by the Shadowserver Foundation on 2025-01-04 UTC.
Affected
ProductAffectedFixed inSource
IP camera, DVR, and NVR Devices1008-1002-1005-1000–CNA
IP camera, DVR, and NVR Devices1009-1003-1006-1001–CNA
IP camera, DVR, and NVR Devices1009Y-1003Y-1006Y-1001Y–CNA
IP camera, DVR, and NVR Devices1010-1004-1007-1001–CNA
IP camera, DVR, and NVR Devices1011-1005-1008-1002–CNA
IP camera, DVR, and NVR Devices1014-1005-1009-1002–CNA
IP camera, DVR, and NVR Devices1015-1006-1010-1003–CNA
IP camera, DVR, and NVR Devices1016-1007-1011-1003–CNA
IP camera, DVR, and NVR Devices1017-1008-1012-1002–CNA
IP camera, DVR, and NVR Devices1017Y-1008Y-1012Y-1002Y–CNA
IP camera, DVR, and NVR Devices1018-1008-1012-1004–CNA
IP camera, DVR, and NVR Devices1019-1009-1013-1003–CNA
Scores by source
VulnCheck (CNA)10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total