← Back to browse · API

CVE-2025-34054

Severity
CRITICAL
CVSS
10.0
EPSS
0.02731
Risk score
40.96
CISA KEV
No
PoC
No
Published
2025-07-01
Modified
2026-04-07
First seen
2026-08-07
Aliases
EUVD-2025-19644, GHSA-5R56-HJHV-6GR3
Products
AVTech:IP camera, DVR, and NVR Devices 1008-1002-1005-1000, AVTech:IP camera, DVR, and NVR Devices 1009-1003-1006-1001, AVTech:IP camera, DVR, and NVR Devices 1009Y-1003Y-1006Y-1001Y, AVTech:IP camera, DVR, and NVR Devices 1010-1004-1007-1001, AVTech:IP camera, DVR, and NVR Devices 1011-1005-1008-1002, AVTech:IP camera, DVR, and NVR Devices 1014-1005-1009-1002, AVTech:IP camera, DVR, and NVR Devices 1015-1006-1010-1003, AVTech:IP camera, DVR, and NVR Devices 1016-1007-1011-1003, AVTech:IP camera, DVR, and NVR Devices 1017-1008-1012-1002, AVTech:IP camera, DVR, and NVR Devices 1017Y-1008Y-1012Y-1002Y, AVTech:IP camera, DVR, and NVR Devices 1018-1008-1012-1004, AVTech:IP camera, DVR, and NVR Devices 1019-1009-1013-1003, AVTech:IP camera, DVR, and NVR Devices 1019c-1012c-1014c-1001c-FFFF, AVTech:IP camera, DVR, and NVR Devices 1022-1014-1016-1002-FFFF, AVTech:IP camera, DVR, and NVR Devices 1022Y-1014Y-1016Y-1002Y-FFFF, AVTech:IP camera, DVR, and NVR Devices 1023-1014-1017-1002-FFFF
Sources
euvd EUVD-2025-19644

Description

An unauthenticated command injection vulnerability exists in AVTECH DVR devices via Search.cgi?action=cgi_query. The use of wget without input sanitization allows attackers to inject shell commands through the username or queryb64str parameters, executing commands as root. Exploitation evidence was observed by the Shadowserver Foundation on 2025-01-04 UTC.

References