IP camera, DVR, and NVR Devices vulnerabilities

3 known vulnerabilities in IP camera, DVR, and NVR Devices from Avtech. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.4 Critical severity

  An OS command injection vulnerability exists in AVTECH IP camera, DVR, and NVR devices via the…

  CVE-2025-34056Jul 1, 2025AvtechEPSS 1.88%

  An OS command injection vulnerability exists in AVTECH IP camera, DVR, and NVR devices via the PwdGrp.cgi endpoint, which handles user and group management operations. Authenticated users can supply input through the pwd or grp parameters, which are directly e

• 9.4 Critical severity

  An OS command injection vulnerability exists in AVTECH DVR, NVR, and IP camera devices within…

  CVE-2025-34055Jul 1, 2025AvtechEPSS 1.57%

  An OS command injection vulnerability exists in AVTECH DVR, NVR, and IP camera devices within the adcommand.cgi endpoint, which interfaces with the ActionD daemon. Authenticated users can invoke the DoShellCmd operation, passing arbitrary input via the strCmd

• 10.0 Critical severity

  IP camera, DVR, and NVR Devices: Improper Neutralization of Special Elements used in an OS Command

  CVE-2025-34054Jul 1, 2025AvtechEPSS 2.72%

  An unauthenticated command injection vulnerability exists in AVTECH DVR devices via Search.cgi?action=cgi_query. The use of wget without input sanitization allows attackers to inject shell commands through the username or queryb64str parameters, executing comm