Unauthenticated Command Injection in AVTECH DVR Devices
CVE-2025-34054

10CRITICAL

Key Information:

Vendor

Avtech

Status
Dvr Devices
Vendor
CVE Published:
1 July 2025

Badges

👾 Exploit Exists

What is CVE-2025-34054?

An unauthenticated command injection vulnerability is present in AVTECH DVR devices, allowing attackers to exploit the device through the Search.cgi?action=cgi_query endpoint. The vulnerability arises from improper input sanitization in the use of wget, enabling attackers to inject malicious shell commands via the username or queryb64str parameters. This can result in the execution of arbitrary commands with root privileges, posing significant security risks to users.

Affected Version(s)

DVR devices 1008-1002-1005-1000

DVR devices 1009-1003-1006-1001

DVR devices 1009Y-1003Y-1006Y-1001Y

References

https://www.exploit-db.com/exploits/40500
exploit
https://avtech.com/
product
https://web.archive.org/web/20240810225729/https://www.se...
third-party-advisorytechnical-description

CVSS V4

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Gergely Eberhardt (SEARCH-LAB.hu)
.
CVE-2025-34054 : Unauthenticated Command Injection in AVTECH DVR Devices