Unauthenticated Command Injection in AVTECH DVR Devices
CVE-2025-34054

10CRITICAL

Key Information:

Vendor: Avtech
Status: Ip Camera, Dvr, And Nvr Devices
Vendor: CVE Published:; 1 July 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-34054?

An unauthenticated command injection vulnerability is present in AVTECH DVR devices, allowing attackers to exploit the device through the Search.cgi?action=cgi_query endpoint. The vulnerability arises from improper input sanitization in the use of wget, enabling attackers to inject malicious shell commands via the username or queryb64str parameters. This can result in the execution of arbitrary commands with root privileges, posing significant security risks to users.

Affected Version(s)

IP camera, DVR, and NVR Devices 1008-1002-1005-1000

IP camera, DVR, and NVR Devices 1009-1003-1006-1001

IP camera, DVR, and NVR Devices 1009Y-1003Y-1006Y-1001Y

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-34054 - Proof of Concept