Avtech vulnerabilities
We track 9 vulnerabilities in Avtech products across 6 products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on December 3, 2025.
Latest Avtech vulnerabilities
- 8.8 High severity
Dgm1104 Firmware: Improper Neutralization of Special Elements used in a Command
AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability in the SMB server function. This vulnerability allows attackers to execute arbitrary commands via a crafted input.
- 8.8 High severity
Dgm1104 Firmware: Improper Neutralization of Special Elements used in a Command
AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability in the NetFailDetectD binary. This vulnerability allows attackers to execute arbitrary commands via a crafted input.
- 8.8 High severity
Dgm1104 Firmware: Improper Neutralization of Special Elements used in a Command
AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability in the Machine.cgi endpoint. This vulnerability allows attackers to execute arbitrary commands via a crafted input.
- 8.8 High severity
Eagleeyes(lite): Improper Certificate Validation
An issue was discovered in the method push.lite.avtech.com.MySSLSocketFactoryNew.checkServerTrusted in AVTECH EagleEyes 2.0.0. The custom X509TrustManager used in checkServerTrusted only checks the certificate's expiration date, skipping proper TLS chain valid
- 9.8 Critical severity
Eagleeyes(lite): Improper Validation of Certificate with Host Mismatch
An issue was discovered in the methods push.lite.avtech.com.AvtechLib.GetHttpsResponse and push.lite.avtech.com.Push_HttpService.getNewHttpClient in AVTECH EagleEyes 2.0.0. The methods set ALLOW_ALL_HOSTNAME_VERIFIER, bypassing domain validation.
- 8.3 High severity
IP cameras: Improper Certificate Validation
An improper certificate validation vulnerability exists in AVTECH IP cameras, DVRs, and NVRs due to the use of wget with --no-check-certificate in scripts like SyncCloudAccount.sh and SyncPermit.sh. This exposes HTTPS communications to man-in-the-middle (MITM)
- 9.4 Critical severity
An OS command injection vulnerability exists in AVTECH IP camera, DVR, and NVR devices via the…
An OS command injection vulnerability exists in AVTECH IP camera, DVR, and NVR devices via the PwdGrp.cgi endpoint, which handles user and group management operations. Authenticated users can supply input through the pwd or grp parameters, which are directly e
- 9.4 Critical severity
An OS command injection vulnerability exists in AVTECH DVR, NVR, and IP camera devices within…
An OS command injection vulnerability exists in AVTECH DVR, NVR, and IP camera devices within the adcommand.cgi endpoint, which interfaces with the ActionD daemon. Authenticated users can invoke the DoShellCmd operation, passing arbitrary input via the strCmd
- 10.0 Critical severity
IP camera, DVR, and NVR Devices: Improper Neutralization of Special Elements used in an OS Command
An unauthenticated command injection vulnerability exists in AVTECH DVR devices via Search.cgi?action=cgi_query. The use of wget without input sanitization allows attackers to inject shell commands through the username or queryb64str parameters, executing comm