Search criteria

6 vulnerabilities found for DVR devices by AVTECH

CVE-2025-34066 (GCVE-0-2025-34066)

Vulnerability from nvd – Published: 2025-07-01 14:47 – Updated: 2025-07-01 18:37
VLAI?
Title
AVTECH IP camera, DVR, and NVR Devices Unauthenticated Information Disclosure
Summary
An improper certificate validation vulnerability exists in AVTECH IP cameras, DVRs, and NVRs due to the use of wget with --no-check-certificate in scripts like SyncCloudAccount.sh and SyncPermit.sh. This exposes HTTPS communications to man-in-the-middle (MITM) attacks.
Severity ?
8.3 (High)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
CWE
  • CWE-295 - Improper Certificate Validation
Assigner
References
Impacted products
Vendor Product Version
AVTECH IP cameras Affected: 0
Create a notification for this product.
Credits
Gergely Eberhardt (SEARCH-LAB.hu)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-34066",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-01T18:37:09.538771Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-01T18:37:36.761Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Cloud sync shell scripts",
            "--no-check-certificate (hardcoded)"
          ],
          "product": "IP cameras",
          "vendor": "AVTECH",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Cloud sync shell scripts",
            "--no-check-certificate (hardcoded)"
          ],
          "product": "DVR devices",
          "vendor": "AVTECH",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Cloud sync shell scripts",
            "--no-check-certificate (hardcoded)"
          ],
          "product": "NVR devices",
          "vendor": "AVTECH",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Gergely Eberhardt (SEARCH-LAB.hu)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An improper certificate validation vulnerability exists in AVTECH IP cameras, DVRs, and NVRs due to the use of wget with --no-check-certificate in scripts like SyncCloudAccount.sh and SyncPermit.sh. This exposes HTTPS communications to man-in-the-middle (MITM) attacks."
            }
          ],
          "value": "An improper certificate validation vulnerability exists in AVTECH IP cameras, DVRs, and NVRs due to the use of wget with --no-check-certificate in scripts like SyncCloudAccount.sh and SyncPermit.sh. This exposes HTTPS communications to man-in-the-middle (MITM) attacks."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-94",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-94 Adversary in the Middle (AiTM)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295 Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-01T14:47:44.573Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "exploit"
          ],
          "url": "https://www.exploit-db.com/exploits/40500"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://avtech.com/"
        },
        {
          "tags": [
            "third-party-advisory",
            "technical-description"
          ],
          "url": "https://web.archive.org/web/20240810225729/https://www.search-lab.hu/advisories/126-AVTech-devices-multiple-vulnerabilities"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://web.archive.org/web/20161029201749/https://github.com/ebux/AVTECH"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "AVTECH IP camera, DVR, and NVR Devices Unauthenticated Information Disclosure",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-34066",
    "datePublished": "2025-07-01T14:47:44.573Z",
    "dateReserved": "2025-04-15T19:15:22.549Z",
    "dateUpdated": "2025-07-01T18:37:36.761Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-34051 (GCVE-0-2025-34051)

Vulnerability from nvd – Published: 2025-07-01 14:44 – Updated: 2025-07-01 14:59
VLAI?
Title
AVTECH DVR Devices Server-Side Request Forgery
Summary
A server-side request forgery vulnerability exists in multiple firmware versions of AVTECH DVR devices that exposes the /cgi-bin/nobody/Search.cgi?action=cgi_query endpoint without authentication. An attacker can manipulate the ip, port, and queryb64str parameters to make arbitrary HTTP requests from the DVR to internal or external systems, potentially exposing sensitive data or interacting with internal services.
Severity ?
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
  • CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
Impacted products
Vendor Product Version
AVTECH DVR devices Affected: 1001-1000-1000-1000
Affected: 1001-1000-1001-1001
Affected: 1002-1000-1002-1001
Unaffected: 1002-1001-1000-1000
Affected: 1002-1001-1001-1001
Affected: 1004-1002-1001-1000
Affected: 1004-1002-1003-1000-FFFF
Affected: 1004V-1002V-1003V-1001V
Affected: 1004Y-1002Y-1001EJ-1000Y
Affected: 1004Y-1002Y-1001Y-1000Y
Affected: 1005-1002-1002-1000
Affected: 1005-1002-1004-1001
Affected: 1006-1001-1003-1004
Affected: 1006-1002-1003-1000
Affected: 1006Y-1002Y-1003Y-1000Y
Affected: 1007-1002-1004-1000
Affected: 1007-1003-1003-1002
Affected: 1007-1003-1005-1001
Affected: 1007E-1003E-1005EJ-1001E
Affected: 1007V-1003V-1005V-1001V
Affected: 1007Y-1002Y-1004Y-1000Y
Affected: 1008-1002-1005-1000
Affected: 1008-1004-1003-1002
Affected: 1009-1003-1005-1006
Affected: 1009-1003-1006-1001
Affected: 1009-1007-1007-1000-FFFF
Affected: 1009Y-1003Y-1006Y-1001Y
Affected: 1010-1004-1007-1001
Affected: 1010-1005-1005-1002
Affected: 1011-1004-1005-1006
Affected: 1011-1005-1007-1001
Affected: 1011-1005-1007EJ-1001
Affected: 1011-1005-1008-1002
Affected: 1012-1004-1005-1006
Affected: 1012-1005-1007-1002
Affected: 1012-1006-1007-1001
Affected: 1012-1008-1009-1000-FFFF
Affected: 1014-1005-1009-1002
Affected: 1014-1007-1009-1001
Affected: 1014-1010-1010-1000-FFFF
Affected: 1014Y-1007Y-1009Y-1001Y
Affected: 1015-1006-1010-1003
Affected: 1015-1007-1007-1007
Affected: 1015-1007-1010-1001
Affected: 1015-1010-1011-1000-FFFF
Affected: 1015Y-1007Y-1010Y-1001Y
Affected: 1016-1007-1005-1001
Affected: 1016-1007-1011-1001
Affected: 1016-1007-1011-1003
Affected: 1016-1008-1007-1007
Affected: 1016Y-1007Y-1011Y-1001Y
Affected: 1017-1008-1012-1002
Affected: 1017-1009-1008-1008
Affected: 1017-1011-1013-1001-FFFF
Affected: 1017f-1011f-1013f-1001f-FFFF
Affected: 1017Y-1008Y-1012Y-1002Y
Affected: 1018-1008-1012-1004
Affected: 1019-1009-1013-1003
Affected: 1019-1010-1009-1009
Affected: 1019c-1012c-1014c-1001c-FFFF
Affected: 1021-1011-1010-1009
Affected: 1022-1012-1011-1009
Affected: 1022-1014-1016-1002-FFFF
Affected: 1022Y-1014Y-1016Y-1002Y-FFFF
Affected: 1023-1013-1011-1009
Affected: 1023-1014-1017-1002-FFFF
Affected: 1025-1014-1013-1009
Affected: 1026-1014-1014-1009
Affected: 1027-1014-1015-1009
Affected: S968-S968-S968-S968
Affected: V171P-V171P-V171P-V171P
Affected: V189-V189-V189-V189
Create a notification for this product.
Credits
Gergely Eberhardt (SEARCH-LAB.hu)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-34051",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-01T14:57:37.177556Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-01T14:59:04.311Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Search.cgi endpoint",
            "ip parameter",
            "port parameter",
            "queryb64str parameter"
          ],
          "product": "DVR devices",
          "vendor": "AVTECH",
          "versions": [
            {
              "status": "affected",
              "version": "1001-1000-1000-1000"
            },
            {
              "status": "affected",
              "version": "1001-1000-1001-1001"
            },
            {
              "status": "affected",
              "version": "1002-1000-1002-1001"
            },
            {
              "status": "unaffected",
              "version": "1002-1001-1000-1000"
            },
            {
              "status": "affected",
              "version": "1002-1001-1001-1001"
            },
            {
              "status": "affected",
              "version": "1004-1002-1001-1000"
            },
            {
              "status": "affected",
              "version": "1004-1002-1003-1000-FFFF"
            },
            {
              "status": "affected",
              "version": "1004V-1002V-1003V-1001V"
            },
            {
              "status": "affected",
              "version": "1004Y-1002Y-1001EJ-1000Y"
            },
            {
              "status": "affected",
              "version": "1004Y-1002Y-1001Y-1000Y"
            },
            {
              "status": "affected",
              "version": "1005-1002-1002-1000"
            },
            {
              "status": "affected",
              "version": "1005-1002-1004-1001"
            },
            {
              "status": "affected",
              "version": "1006-1001-1003-1004"
            },
            {
              "status": "affected",
              "version": "1006-1002-1003-1000"
            },
            {
              "status": "affected",
              "version": "1006Y-1002Y-1003Y-1000Y"
            },
            {
              "status": "affected",
              "version": "1007-1002-1004-1000"
            },
            {
              "status": "affected",
              "version": "1007-1003-1003-1002"
            },
            {
              "status": "affected",
              "version": "1007-1003-1005-1001"
            },
            {
              "status": "affected",
              "version": "1007E-1003E-1005EJ-1001E"
            },
            {
              "status": "affected",
              "version": "1007V-1003V-1005V-1001V"
            },
            {
              "status": "affected",
              "version": "1007Y-1002Y-1004Y-1000Y"
            },
            {
              "status": "affected",
              "version": "1008-1002-1005-1000"
            },
            {
              "status": "affected",
              "version": "1008-1004-1003-1002"
            },
            {
              "status": "affected",
              "version": "1009-1003-1005-1006"
            },
            {
              "status": "affected",
              "version": "1009-1003-1006-1001"
            },
            {
              "status": "affected",
              "version": "1009-1007-1007-1000-FFFF"
            },
            {
              "status": "affected",
              "version": "1009Y-1003Y-1006Y-1001Y"
            },
            {
              "status": "affected",
              "version": "1010-1004-1007-1001"
            },
            {
              "status": "affected",
              "version": "1010-1005-1005-1002"
            },
            {
              "status": "affected",
              "version": "1011-1004-1005-1006"
            },
            {
              "status": "affected",
              "version": "1011-1005-1007-1001"
            },
            {
              "status": "affected",
              "version": "1011-1005-1007EJ-1001"
            },
            {
              "status": "affected",
              "version": "1011-1005-1008-1002"
            },
            {
              "status": "affected",
              "version": "1012-1004-1005-1006"
            },
            {
              "status": "affected",
              "version": "1012-1005-1007-1002"
            },
            {
              "status": "affected",
              "version": "1012-1006-1007-1001"
            },
            {
              "status": "affected",
              "version": "1012-1008-1009-1000-FFFF"
            },
            {
              "status": "affected",
              "version": "1014-1005-1009-1002"
            },
            {
              "status": "affected",
              "version": "1014-1007-1009-1001"
            },
            {
              "status": "affected",
              "version": "1014-1010-1010-1000-FFFF"
            },
            {
              "status": "affected",
              "version": "1014Y-1007Y-1009Y-1001Y"
            },
            {
              "status": "affected",
              "version": "1015-1006-1010-1003"
            },
            {
              "status": "affected",
              "version": "1015-1007-1007-1007"
            },
            {
              "status": "affected",
              "version": "1015-1007-1010-1001"
            },
            {
              "status": "affected",
              "version": "1015-1010-1011-1000-FFFF"
            },
            {
              "status": "affected",
              "version": "1015Y-1007Y-1010Y-1001Y"
            },
            {
              "status": "affected",
              "version": "1016-1007-1005-1001"
            },
            {
              "status": "affected",
              "version": "1016-1007-1011-1001"
            },
            {
              "status": "affected",
              "version": "1016-1007-1011-1003"
            },
            {
              "status": "affected",
              "version": "1016-1008-1007-1007"
            },
            {
              "status": "affected",
              "version": "1016Y-1007Y-1011Y-1001Y"
            },
            {
              "status": "affected",
              "version": "1017-1008-1012-1002"
            },
            {
              "status": "affected",
              "version": "1017-1009-1008-1008"
            },
            {
              "status": "affected",
              "version": "1017-1011-1013-1001-FFFF"
            },
            {
              "status": "affected",
              "version": "1017f-1011f-1013f-1001f-FFFF"
            },
            {
              "status": "affected",
              "version": "1017Y-1008Y-1012Y-1002Y"
            },
            {
              "status": "affected",
              "version": "1018-1008-1012-1004"
            },
            {
              "status": "affected",
              "version": "1019-1009-1013-1003"
            },
            {
              "status": "affected",
              "version": "1019-1010-1009-1009"
            },
            {
              "status": "affected",
              "version": "1019c-1012c-1014c-1001c-FFFF"
            },
            {
              "status": "affected",
              "version": "1021-1011-1010-1009"
            },
            {
              "status": "affected",
              "version": "1022-1012-1011-1009"
            },
            {
              "status": "affected",
              "version": "1022-1014-1016-1002-FFFF"
            },
            {
              "status": "affected",
              "version": "1022Y-1014Y-1016Y-1002Y-FFFF"
            },
            {
              "status": "affected",
              "version": "1023-1013-1011-1009"
            },
            {
              "status": "affected",
              "version": "1023-1014-1017-1002-FFFF"
            },
            {
              "status": "affected",
              "version": "1025-1014-1013-1009"
            },
            {
              "status": "affected",
              "version": "1026-1014-1014-1009"
            },
            {
              "status": "affected",
              "version": "1027-1014-1015-1009"
            },
            {
              "status": "affected",
              "version": "S968-S968-S968-S968"
            },
            {
              "status": "affected",
              "version": "V171P-V171P-V171P-V171P"
            },
            {
              "status": "affected",
              "version": "V189-V189-V189-V189"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Gergely Eberhardt (SEARCH-LAB.hu)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A server-side request forgery vulnerability exists in multiple firmware versions of AVTECH DVR devices that exposes the \u003ccode\u003e/cgi-bin/nobody/Search.cgi?action=cgi_query\u003c/code\u003e endpoint without authentication. An attacker can manipulate the \u003ccode\u003eip\u003c/code\u003e, \u003ccode\u003eport\u003c/code\u003e, and \u003ccode\u003equeryb64str\u003c/code\u003e parameters to make arbitrary HTTP requests from the DVR to internal or external systems, potentially exposing sensitive data or interacting with internal services."
            }
          ],
          "value": "A server-side request forgery vulnerability exists in multiple firmware versions of AVTECH DVR devices that exposes the /cgi-bin/nobody/Search.cgi?action=cgi_query endpoint without authentication. An attacker can manipulate the ip, port, and queryb64str parameters to make arbitrary HTTP requests from the DVR to internal or external systems, potentially exposing sensitive data or interacting with internal services."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-664",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-664 Server Side Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-01T14:44:22.913Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "exploit"
          ],
          "url": "https://www.exploit-db.com/exploits/40500"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://avtech.com/"
        },
        {
          "tags": [
            "third-party-advisory",
            "technical-description"
          ],
          "url": "https://web.archive.org/web/20240810225729/https://www.search-lab.hu/advisories/126-AVTech-devices-multiple-vulnerabilities"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://web.archive.org/web/20161029201749/https://github.com/ebux/AVTECH"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "AVTECH DVR Devices Server-Side Request Forgery",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-34051",
    "datePublished": "2025-07-01T14:44:22.913Z",
    "dateReserved": "2025-04-15T19:15:22.548Z",
    "dateUpdated": "2025-07-01T14:59:04.311Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-34050 (GCVE-0-2025-34050)

Vulnerability from nvd – Published: 2025-07-01 14:42 – Updated: 2025-07-01 18:45
VLAI?
Title
AVTECH IP Camera, DVR, and NVR Devices Cross-Site Request Forgery
Summary
A cross-site request forgery (CSRF) vulnerability exists in the web interface of AVTECH IP camera, DVR, and NVR devices. An attacker can craft malicious requests that, when executed in the context of an authenticated user’s browser session, allow unauthorized changes to the device configuration without user interaction.
Severity ?
5.1 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CWE
  • CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
Impacted products
Vendor Product Version
AVTECH IP cameras Affected: 0
Create a notification for this product.
Credits
Gergely Eberhardt (SEARCH-LAB.hu)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-34050",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-01T18:44:55.395830Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-01T18:45:06.703Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Web Management Interface (configuration endpoints)"
          ],
          "product": "IP cameras",
          "vendor": "AVTECH",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Web Management Interface (configuration endpoints)"
          ],
          "product": "DVR devices",
          "vendor": "AVTECH",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Web Management Interface (configuration endpoints)"
          ],
          "product": "NVR devices",
          "vendor": "AVTECH",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Gergely Eberhardt (SEARCH-LAB.hu)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A\u0026nbsp;cross-site request forgery (CSRF) vulnerability exists in the web interface of AVTECH IP camera, DVR, and NVR devices. An attacker can craft malicious requests that, when executed in the context of an authenticated user\u2019s browser session, allow unauthorized changes to the device configuration without user interaction."
            }
          ],
          "value": "A\u00a0cross-site request forgery (CSRF) vulnerability exists in the web interface of AVTECH IP camera, DVR, and NVR devices. An attacker can craft malicious requests that, when executed in the context of an authenticated user\u2019s browser session, allow unauthorized changes to the device configuration without user interaction."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-62",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-62 Cross Site Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-01T14:42:57.143Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "exploit"
          ],
          "url": "https://www.exploit-db.com/exploits/40500"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://avtech.com/"
        },
        {
          "tags": [
            "third-party-advisory",
            "technical-description"
          ],
          "url": "https://web.archive.org/web/20240810225729/https://www.search-lab.hu/advisories/126-AVTech-devices-multiple-vulnerabilities"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://web.archive.org/web/20161029201749/https://github.com/ebux/AVTECH"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "AVTECH IP Camera, DVR, and NVR Devices Cross-Site Request Forgery",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-34050",
    "datePublished": "2025-07-01T14:42:57.143Z",
    "dateReserved": "2025-04-15T19:15:22.548Z",
    "dateUpdated": "2025-07-01T18:45:06.703Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-34066 (GCVE-0-2025-34066)

Vulnerability from cvelistv5 – Published: 2025-07-01 14:47 – Updated: 2025-07-01 18:37
VLAI?
Title
AVTECH IP camera, DVR, and NVR Devices Unauthenticated Information Disclosure
Summary
An improper certificate validation vulnerability exists in AVTECH IP cameras, DVRs, and NVRs due to the use of wget with --no-check-certificate in scripts like SyncCloudAccount.sh and SyncPermit.sh. This exposes HTTPS communications to man-in-the-middle (MITM) attacks.
Severity ?
8.3 (High)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
CWE
  • CWE-295 - Improper Certificate Validation
Assigner
References
Impacted products
Vendor Product Version
AVTECH IP cameras Affected: 0
Create a notification for this product.
Credits
Gergely Eberhardt (SEARCH-LAB.hu)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-34066",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-01T18:37:09.538771Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-01T18:37:36.761Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Cloud sync shell scripts",
            "--no-check-certificate (hardcoded)"
          ],
          "product": "IP cameras",
          "vendor": "AVTECH",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Cloud sync shell scripts",
            "--no-check-certificate (hardcoded)"
          ],
          "product": "DVR devices",
          "vendor": "AVTECH",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Cloud sync shell scripts",
            "--no-check-certificate (hardcoded)"
          ],
          "product": "NVR devices",
          "vendor": "AVTECH",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Gergely Eberhardt (SEARCH-LAB.hu)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An improper certificate validation vulnerability exists in AVTECH IP cameras, DVRs, and NVRs due to the use of wget with --no-check-certificate in scripts like SyncCloudAccount.sh and SyncPermit.sh. This exposes HTTPS communications to man-in-the-middle (MITM) attacks."
            }
          ],
          "value": "An improper certificate validation vulnerability exists in AVTECH IP cameras, DVRs, and NVRs due to the use of wget with --no-check-certificate in scripts like SyncCloudAccount.sh and SyncPermit.sh. This exposes HTTPS communications to man-in-the-middle (MITM) attacks."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-94",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-94 Adversary in the Middle (AiTM)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295 Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-01T14:47:44.573Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "exploit"
          ],
          "url": "https://www.exploit-db.com/exploits/40500"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://avtech.com/"
        },
        {
          "tags": [
            "third-party-advisory",
            "technical-description"
          ],
          "url": "https://web.archive.org/web/20240810225729/https://www.search-lab.hu/advisories/126-AVTech-devices-multiple-vulnerabilities"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://web.archive.org/web/20161029201749/https://github.com/ebux/AVTECH"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "AVTECH IP camera, DVR, and NVR Devices Unauthenticated Information Disclosure",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-34066",
    "datePublished": "2025-07-01T14:47:44.573Z",
    "dateReserved": "2025-04-15T19:15:22.549Z",
    "dateUpdated": "2025-07-01T18:37:36.761Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-34051 (GCVE-0-2025-34051)

Vulnerability from cvelistv5 – Published: 2025-07-01 14:44 – Updated: 2025-07-01 14:59
VLAI?
Title
AVTECH DVR Devices Server-Side Request Forgery
Summary
A server-side request forgery vulnerability exists in multiple firmware versions of AVTECH DVR devices that exposes the /cgi-bin/nobody/Search.cgi?action=cgi_query endpoint without authentication. An attacker can manipulate the ip, port, and queryb64str parameters to make arbitrary HTTP requests from the DVR to internal or external systems, potentially exposing sensitive data or interacting with internal services.
Severity ?
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
  • CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
Impacted products
Vendor Product Version
AVTECH DVR devices Affected: 1001-1000-1000-1000
Affected: 1001-1000-1001-1001
Affected: 1002-1000-1002-1001
Unaffected: 1002-1001-1000-1000
Affected: 1002-1001-1001-1001
Affected: 1004-1002-1001-1000
Affected: 1004-1002-1003-1000-FFFF
Affected: 1004V-1002V-1003V-1001V
Affected: 1004Y-1002Y-1001EJ-1000Y
Affected: 1004Y-1002Y-1001Y-1000Y
Affected: 1005-1002-1002-1000
Affected: 1005-1002-1004-1001
Affected: 1006-1001-1003-1004
Affected: 1006-1002-1003-1000
Affected: 1006Y-1002Y-1003Y-1000Y
Affected: 1007-1002-1004-1000
Affected: 1007-1003-1003-1002
Affected: 1007-1003-1005-1001
Affected: 1007E-1003E-1005EJ-1001E
Affected: 1007V-1003V-1005V-1001V
Affected: 1007Y-1002Y-1004Y-1000Y
Affected: 1008-1002-1005-1000
Affected: 1008-1004-1003-1002
Affected: 1009-1003-1005-1006
Affected: 1009-1003-1006-1001
Affected: 1009-1007-1007-1000-FFFF
Affected: 1009Y-1003Y-1006Y-1001Y
Affected: 1010-1004-1007-1001
Affected: 1010-1005-1005-1002
Affected: 1011-1004-1005-1006
Affected: 1011-1005-1007-1001
Affected: 1011-1005-1007EJ-1001
Affected: 1011-1005-1008-1002
Affected: 1012-1004-1005-1006
Affected: 1012-1005-1007-1002
Affected: 1012-1006-1007-1001
Affected: 1012-1008-1009-1000-FFFF
Affected: 1014-1005-1009-1002
Affected: 1014-1007-1009-1001
Affected: 1014-1010-1010-1000-FFFF
Affected: 1014Y-1007Y-1009Y-1001Y
Affected: 1015-1006-1010-1003
Affected: 1015-1007-1007-1007
Affected: 1015-1007-1010-1001
Affected: 1015-1010-1011-1000-FFFF
Affected: 1015Y-1007Y-1010Y-1001Y
Affected: 1016-1007-1005-1001
Affected: 1016-1007-1011-1001
Affected: 1016-1007-1011-1003
Affected: 1016-1008-1007-1007
Affected: 1016Y-1007Y-1011Y-1001Y
Affected: 1017-1008-1012-1002
Affected: 1017-1009-1008-1008
Affected: 1017-1011-1013-1001-FFFF
Affected: 1017f-1011f-1013f-1001f-FFFF
Affected: 1017Y-1008Y-1012Y-1002Y
Affected: 1018-1008-1012-1004
Affected: 1019-1009-1013-1003
Affected: 1019-1010-1009-1009
Affected: 1019c-1012c-1014c-1001c-FFFF
Affected: 1021-1011-1010-1009
Affected: 1022-1012-1011-1009
Affected: 1022-1014-1016-1002-FFFF
Affected: 1022Y-1014Y-1016Y-1002Y-FFFF
Affected: 1023-1013-1011-1009
Affected: 1023-1014-1017-1002-FFFF
Affected: 1025-1014-1013-1009
Affected: 1026-1014-1014-1009
Affected: 1027-1014-1015-1009
Affected: S968-S968-S968-S968
Affected: V171P-V171P-V171P-V171P
Affected: V189-V189-V189-V189
Create a notification for this product.
Credits
Gergely Eberhardt (SEARCH-LAB.hu)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-34051",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-01T14:57:37.177556Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-01T14:59:04.311Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Search.cgi endpoint",
            "ip parameter",
            "port parameter",
            "queryb64str parameter"
          ],
          "product": "DVR devices",
          "vendor": "AVTECH",
          "versions": [
            {
              "status": "affected",
              "version": "1001-1000-1000-1000"
            },
            {
              "status": "affected",
              "version": "1001-1000-1001-1001"
            },
            {
              "status": "affected",
              "version": "1002-1000-1002-1001"
            },
            {
              "status": "unaffected",
              "version": "1002-1001-1000-1000"
            },
            {
              "status": "affected",
              "version": "1002-1001-1001-1001"
            },
            {
              "status": "affected",
              "version": "1004-1002-1001-1000"
            },
            {
              "status": "affected",
              "version": "1004-1002-1003-1000-FFFF"
            },
            {
              "status": "affected",
              "version": "1004V-1002V-1003V-1001V"
            },
            {
              "status": "affected",
              "version": "1004Y-1002Y-1001EJ-1000Y"
            },
            {
              "status": "affected",
              "version": "1004Y-1002Y-1001Y-1000Y"
            },
            {
              "status": "affected",
              "version": "1005-1002-1002-1000"
            },
            {
              "status": "affected",
              "version": "1005-1002-1004-1001"
            },
            {
              "status": "affected",
              "version": "1006-1001-1003-1004"
            },
            {
              "status": "affected",
              "version": "1006-1002-1003-1000"
            },
            {
              "status": "affected",
              "version": "1006Y-1002Y-1003Y-1000Y"
            },
            {
              "status": "affected",
              "version": "1007-1002-1004-1000"
            },
            {
              "status": "affected",
              "version": "1007-1003-1003-1002"
            },
            {
              "status": "affected",
              "version": "1007-1003-1005-1001"
            },
            {
              "status": "affected",
              "version": "1007E-1003E-1005EJ-1001E"
            },
            {
              "status": "affected",
              "version": "1007V-1003V-1005V-1001V"
            },
            {
              "status": "affected",
              "version": "1007Y-1002Y-1004Y-1000Y"
            },
            {
              "status": "affected",
              "version": "1008-1002-1005-1000"
            },
            {
              "status": "affected",
              "version": "1008-1004-1003-1002"
            },
            {
              "status": "affected",
              "version": "1009-1003-1005-1006"
            },
            {
              "status": "affected",
              "version": "1009-1003-1006-1001"
            },
            {
              "status": "affected",
              "version": "1009-1007-1007-1000-FFFF"
            },
            {
              "status": "affected",
              "version": "1009Y-1003Y-1006Y-1001Y"
            },
            {
              "status": "affected",
              "version": "1010-1004-1007-1001"
            },
            {
              "status": "affected",
              "version": "1010-1005-1005-1002"
            },
            {
              "status": "affected",
              "version": "1011-1004-1005-1006"
            },
            {
              "status": "affected",
              "version": "1011-1005-1007-1001"
            },
            {
              "status": "affected",
              "version": "1011-1005-1007EJ-1001"
            },
            {
              "status": "affected",
              "version": "1011-1005-1008-1002"
            },
            {
              "status": "affected",
              "version": "1012-1004-1005-1006"
            },
            {
              "status": "affected",
              "version": "1012-1005-1007-1002"
            },
            {
              "status": "affected",
              "version": "1012-1006-1007-1001"
            },
            {
              "status": "affected",
              "version": "1012-1008-1009-1000-FFFF"
            },
            {
              "status": "affected",
              "version": "1014-1005-1009-1002"
            },
            {
              "status": "affected",
              "version": "1014-1007-1009-1001"
            },
            {
              "status": "affected",
              "version": "1014-1010-1010-1000-FFFF"
            },
            {
              "status": "affected",
              "version": "1014Y-1007Y-1009Y-1001Y"
            },
            {
              "status": "affected",
              "version": "1015-1006-1010-1003"
            },
            {
              "status": "affected",
              "version": "1015-1007-1007-1007"
            },
            {
              "status": "affected",
              "version": "1015-1007-1010-1001"
            },
            {
              "status": "affected",
              "version": "1015-1010-1011-1000-FFFF"
            },
            {
              "status": "affected",
              "version": "1015Y-1007Y-1010Y-1001Y"
            },
            {
              "status": "affected",
              "version": "1016-1007-1005-1001"
            },
            {
              "status": "affected",
              "version": "1016-1007-1011-1001"
            },
            {
              "status": "affected",
              "version": "1016-1007-1011-1003"
            },
            {
              "status": "affected",
              "version": "1016-1008-1007-1007"
            },
            {
              "status": "affected",
              "version": "1016Y-1007Y-1011Y-1001Y"
            },
            {
              "status": "affected",
              "version": "1017-1008-1012-1002"
            },
            {
              "status": "affected",
              "version": "1017-1009-1008-1008"
            },
            {
              "status": "affected",
              "version": "1017-1011-1013-1001-FFFF"
            },
            {
              "status": "affected",
              "version": "1017f-1011f-1013f-1001f-FFFF"
            },
            {
              "status": "affected",
              "version": "1017Y-1008Y-1012Y-1002Y"
            },
            {
              "status": "affected",
              "version": "1018-1008-1012-1004"
            },
            {
              "status": "affected",
              "version": "1019-1009-1013-1003"
            },
            {
              "status": "affected",
              "version": "1019-1010-1009-1009"
            },
            {
              "status": "affected",
              "version": "1019c-1012c-1014c-1001c-FFFF"
            },
            {
              "status": "affected",
              "version": "1021-1011-1010-1009"
            },
            {
              "status": "affected",
              "version": "1022-1012-1011-1009"
            },
            {
              "status": "affected",
              "version": "1022-1014-1016-1002-FFFF"
            },
            {
              "status": "affected",
              "version": "1022Y-1014Y-1016Y-1002Y-FFFF"
            },
            {
              "status": "affected",
              "version": "1023-1013-1011-1009"
            },
            {
              "status": "affected",
              "version": "1023-1014-1017-1002-FFFF"
            },
            {
              "status": "affected",
              "version": "1025-1014-1013-1009"
            },
            {
              "status": "affected",
              "version": "1026-1014-1014-1009"
            },
            {
              "status": "affected",
              "version": "1027-1014-1015-1009"
            },
            {
              "status": "affected",
              "version": "S968-S968-S968-S968"
            },
            {
              "status": "affected",
              "version": "V171P-V171P-V171P-V171P"
            },
            {
              "status": "affected",
              "version": "V189-V189-V189-V189"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Gergely Eberhardt (SEARCH-LAB.hu)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A server-side request forgery vulnerability exists in multiple firmware versions of AVTECH DVR devices that exposes the \u003ccode\u003e/cgi-bin/nobody/Search.cgi?action=cgi_query\u003c/code\u003e endpoint without authentication. An attacker can manipulate the \u003ccode\u003eip\u003c/code\u003e, \u003ccode\u003eport\u003c/code\u003e, and \u003ccode\u003equeryb64str\u003c/code\u003e parameters to make arbitrary HTTP requests from the DVR to internal or external systems, potentially exposing sensitive data or interacting with internal services."
            }
          ],
          "value": "A server-side request forgery vulnerability exists in multiple firmware versions of AVTECH DVR devices that exposes the /cgi-bin/nobody/Search.cgi?action=cgi_query endpoint without authentication. An attacker can manipulate the ip, port, and queryb64str parameters to make arbitrary HTTP requests from the DVR to internal or external systems, potentially exposing sensitive data or interacting with internal services."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-664",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-664 Server Side Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-01T14:44:22.913Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "exploit"
          ],
          "url": "https://www.exploit-db.com/exploits/40500"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://avtech.com/"
        },
        {
          "tags": [
            "third-party-advisory",
            "technical-description"
          ],
          "url": "https://web.archive.org/web/20240810225729/https://www.search-lab.hu/advisories/126-AVTech-devices-multiple-vulnerabilities"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://web.archive.org/web/20161029201749/https://github.com/ebux/AVTECH"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "AVTECH DVR Devices Server-Side Request Forgery",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-34051",
    "datePublished": "2025-07-01T14:44:22.913Z",
    "dateReserved": "2025-04-15T19:15:22.548Z",
    "dateUpdated": "2025-07-01T14:59:04.311Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-34050 (GCVE-0-2025-34050)

Vulnerability from cvelistv5 – Published: 2025-07-01 14:42 – Updated: 2025-07-01 18:45
VLAI?
Title
AVTECH IP Camera, DVR, and NVR Devices Cross-Site Request Forgery
Summary
A cross-site request forgery (CSRF) vulnerability exists in the web interface of AVTECH IP camera, DVR, and NVR devices. An attacker can craft malicious requests that, when executed in the context of an authenticated user’s browser session, allow unauthorized changes to the device configuration without user interaction.
Severity ?
5.1 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CWE
  • CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
Impacted products
Vendor Product Version
AVTECH IP cameras Affected: 0
Create a notification for this product.
Credits
Gergely Eberhardt (SEARCH-LAB.hu)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-34050",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-01T18:44:55.395830Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-01T18:45:06.703Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Web Management Interface (configuration endpoints)"
          ],
          "product": "IP cameras",
          "vendor": "AVTECH",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Web Management Interface (configuration endpoints)"
          ],
          "product": "DVR devices",
          "vendor": "AVTECH",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Web Management Interface (configuration endpoints)"
          ],
          "product": "NVR devices",
          "vendor": "AVTECH",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Gergely Eberhardt (SEARCH-LAB.hu)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A\u0026nbsp;cross-site request forgery (CSRF) vulnerability exists in the web interface of AVTECH IP camera, DVR, and NVR devices. An attacker can craft malicious requests that, when executed in the context of an authenticated user\u2019s browser session, allow unauthorized changes to the device configuration without user interaction."
            }
          ],
          "value": "A\u00a0cross-site request forgery (CSRF) vulnerability exists in the web interface of AVTECH IP camera, DVR, and NVR devices. An attacker can craft malicious requests that, when executed in the context of an authenticated user\u2019s browser session, allow unauthorized changes to the device configuration without user interaction."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-62",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-62 Cross Site Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-01T14:42:57.143Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "exploit"
          ],
          "url": "https://www.exploit-db.com/exploits/40500"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://avtech.com/"
        },
        {
          "tags": [
            "third-party-advisory",
            "technical-description"
          ],
          "url": "https://web.archive.org/web/20240810225729/https://www.search-lab.hu/advisories/126-AVTech-devices-multiple-vulnerabilities"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://web.archive.org/web/20161029201749/https://github.com/ebux/AVTECH"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "AVTECH IP Camera, DVR, and NVR Devices Cross-Site Request Forgery",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-34050",
    "datePublished": "2025-07-01T14:42:57.143Z",
    "dateReserved": "2025-04-15T19:15:22.548Z",
    "dateUpdated": "2025-07-01T18:45:06.703Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}