OS Command Injection Vulnerability in TB-eye Network Recorders
CVE-2025-36529

8.6HIGH

Key Information:

Vendor: Tb-eye Ltd.
Status: Xrn-410sn/te; Xrn-810sn/te; Xrn-1610sn/te; Prn-4011n/te
Vendor: CVE Published:; 27 June 2025

🔔 Create Tb-eye Ltd. Vulnerability Alert

What is CVE-2025-36529?

An OS command injection vulnerability exists in various TB-eye network and AHD recorders, potentially allowing an attacker to execute arbitrary operating system commands upon successfully logging into the device. This security issue may facilitate unauthorized access and control over the affected systems, posing significant risks to data integrity and device functionality.

Affected Version(s)

HRX-1621/TE firmware versions Ver3.05.62 and earlier

HRX-1635/TE firmware versions Ver5.31.72 and earlier

HRX-421FN/TE firmware versions Ver3.05.62 and earlier

References

https://www.tbeye.com/topics/ahd/

https://jvn.jp/en/vu/JVNVU93396297/

CVSS V4

Score:

8.6

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jun 27, 2025
Vulnerability Reserved
Jun 24, 2025

JSON