{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-34055","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","state":"PUBLISHED","assignerShortName":"VulnCheck","dateReserved":"2025-04-15T19:15:22.548Z","datePublished":"2025-07-01T14:46:38.848Z","dateUpdated":"2026-04-07T14:09:16.960Z"},"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","modules":["cgi-bin/supervisor/adcommand.cgi","strCmd within DoShellCmd"],"product":"IP camera, DVR, and NVR Devices","vendor":"AVTECH","versions":[{"status":"affected","version":"1001-1000-1000-1000"},{"status":"affected","version":"1002-1000-1000-1000"},{"status":"affected","version":"1002-1001-1001-1001"},{"status":"affected","version":"1003-1000-1001-1000"},{"status":"affected","version":"1003-1001-1001-1000"},{"status":"affected","version":"1003-1001-1001-1001"},{"status":"affected","version":"1004-1000-1000-1000"},{"status":"affected","version":"1004-1001-1001-1001"},{"status":"affected","version":"1004-1001-1002-1000"},{"status":"affected","version":"1004-1002-1001-1000"},{"status":"affected","version":"1004V-1002V-1003V-1001V"},{"status":"affected","version":"1004Y-1002Y-1001EJ-1000Y"},{"status":"affected","version":"1005-1001-1002-1000"},{"status":"affected","version":"1005-1002-1001-1002"},{"status":"affected","version":"1005-1002-1002-1000"},{"status":"affected","version":"1005-1002-1004-1001"},{"status":"affected","version":"1006-1001-1003-1000"},{"status":"affected","version":"1006-1001-1003-1003"},{"status":"affected","version":"1006-1002-1001-1002"},{"status":"affected","version":"1006-1002-1003-1000"},{"status":"affected","version":"1006R-1002R-1001R-1002R"},{"status":"affected","version":"1007-1001-1003-1000"},{"status":"affected","version":"1007-1001-1003-1003"},{"status":"affected","version":"1007-1002-1004-1000"},{"status":"affected","version":"1007-1003-1005-1001"},{"status":"affected","version":"1007E-1003E-1005EJ-1001E"},{"status":"affected","version":"1007V-1003V-1005V-1001V"},{"status":"affected","version":"1008-1001-1001-1001"},{"status":"affected","version":"1008-1002-1002-1003"},{"status":"affected","version":"1008-1002-1005-1000"},{"status":"affected","version":"1008-1003-1005-1003"},{"status":"affected","version":"1008-1004-1003-1002"},{"status":"affected","version":"1009-1001-1002-1001"},{"status":"affected","version":"1009-1001-1004-1000"},{"status":"affected","version":"1009-1003-1006-1001"},{"status":"affected","version":"1009-1004-1005-1006"},{"status":"affected","version":"1009-1004-1006-1003"},{"status":"affected","version":"1009Y-1003Y-1006Y-1001Y"},{"status":"affected","version":"1010-1001-1003-1001"},{"status":"affected","version":"1010-1001-1004-1005"},{"status":"affected","version":"1010-1002-1005-1000"},{"status":"affected","version":"1010-1004-1007-1001"},{"status":"affected","version":"1010-1005-1005-1002"},{"status":"affected","version":"1011-1002-1004-1001"},{"status":"affected","version":"1011-1002-1006-1000"},{"status":"affected","version":"1011-1005-1007EJ-1001"},{"status":"affected","version":"1011-1005-1008-1002"},{"status":"affected","version":"1012-1002-1004-1001"},{"status":"affected","version":"1012-1002-1006-1005"},{"status":"affected","version":"1012-1002-1007-1004"},{"status":"affected","version":"1012-1003-1001-1005"},{"status":"affected","version":"1012-1003-1005-1005"},{"status":"affected","version":"1012-1004-1008-1008"},{"status":"affected","version":"1012-1008-1009-1000-FFFF"},{"status":"affected","version":"1013-1002-1006-1005"},{"status":"affected","version":"1013-1003-1005-1001"},{"status":"affected","version":"1013-1004-1008-1003"},{"status":"affected","version":"1013-1004-1008-1008"},{"status":"affected","version":"1014-1002-1007-1004"},{"status":"affected","version":"1014-1003-1006-1001"},{"status":"affected","version":"1014-1003-1006PL-1001"},{"status":"affected","version":"1014-1003-1007-1001"},{"status":"affected","version":"1014-1004-1008-1008"},{"status":"affected","version":"1014-1005-1009-1002"},{"status":"affected","version":"1014-1007-1009-1001"},{"status":"affected","version":"1014L-1002L-1006L-1005L"},{"status":"affected","version":"1015-1006-1004-1002"},{"status":"affected","version":"1015-1006-1005-1002"},{"status":"affected","version":"1015-1006-1008-1002"},{"status":"affected","version":"1015-1006-1008-1007"},{"status":"affected","version":"1015-1006-1010-1003"},{"status":"affected","version":"1015-1007-1007-1007"},{"status":"affected","version":"1015K-1006K-1008PO-1002K"},{"status":"affected","version":"1015Y-1007Y-1010Y-1001Y"},{"status":"affected","version":"1016-1003-1007-1001"},{"status":"affected","version":"1016-1004-1009-1009"},{"status":"affected","version":"1016-1006-1008-1007"},{"status":"affected","version":"1016-1007-1005-1001"},{"status":"affected","version":"1016-1007-1009-1003"},{"status":"affected","version":"1016-1007-1011-1001"},{"status":"affected","version":"1016-1007-1011-1003"},{"status":"affected","version":"1016-1008-1007-1007"},{"status":"affected","version":"1016Y-1007Y-1011Y-1001Y"},{"status":"affected","version":"1017-1002-1008-1005"},{"status":"affected","version":"1017-1003-1007-1002"},{"status":"affected","version":"1017-1003-1008-1006"},{"status":"affected","version":"1017-1008-1012-1002"},{"status":"affected","version":"1017-1011-1013-1001-FFFF"},{"status":"affected","version":"1017k-1003k-1008k-1006k"},{"status":"affected","version":"1017Y-1008Y-1012Y-1002Y"},{"status":"affected","version":"1018-1003-1005-1004"},{"status":"affected","version":"1018-1003-1007-1002"},{"status":"affected","version":"1018-1003-1008-1003"},{"status":"affected","version":"1018-1003-1008-1004"},{"status":"affected","version":"1018-1003-1008PO-1003"},{"status":"affected","version":"1018-1006-1009-1007"},{"status":"affected","version":"1018-1007-1009-1003"},{"status":"affected","version":"1018-1008-1012-1004"},{"status":"affected","version":"1019-1003-1007-1002"},{"status":"affected","version":"1019-1003-1008-1001"},{"status":"affected","version":"1019-1004-1009-1007"},{"status":"affected","version":"1019-1007-1009-1003"},{"status":"affected","version":"1019-1009-1013-1003"},{"status":"affected","version":"1019-1010-1009-1009"},{"status":"affected","version":"1019c-1012c-1014c-1001c-FFFF"},{"status":"affected","version":"1020-1003-1008-1003"},{"status":"affected","version":"1020-1003-1008-1004"},{"status":"affected","version":"1020-1003-1010-1006"},{"status":"affected","version":"1020-1004-1009-1007"},{"status":"affected","version":"1020-1005-1011-1010"},{"status":"affected","version":"1020-1005-1012-1007"},{"status":"affected","version":"1020-1007-1008-1003"},{"status":"affected","version":"1020-1007-1009-1003"},{"status":"affected","version":"1021-1003-1008-1003"},{"status":"affected","version":"1021-1003-1008-1004"},{"status":"affected","version":"1021-1005-1011-1010"},{"status":"affected","version":"1021-1007-1010-1003"},{"status":"affected","version":"1021L-1003L-1010L-1006L"},{"status":"affected","version":"1021r-1004r-1009r-1007r"},{"status":"affected","version":"1022-1003-1008-1002"},{"status":"affected","version":"1022-1004-1009-1007"},{"status":"affected","version":"1022-1007-1012-1007"},{"status":"affected","version":"1022-1012-1011-1009"},{"status":"affected","version":"1022-1014-1016-1002-FFFF"},{"status":"affected","version":"1022L-1004L-1011L-1006L"},{"status":"affected","version":"1022L-1005L-1011L-1010L"},{"status":"affected","version":"1022Y-1014Y-1016Y-1002Y-FFFF"},{"status":"affected","version":"1023-1004-1010-1007"},{"status":"affected","version":"1023-1014-1017-1002-FFFF"},{"status":"affected","version":"1025-1006-1013-1011"},{"status":"affected","version":"1025-1008-1013-1008"},{"status":"affected","version":"1025-1014-1013-1009"},{"status":"affected","version":"1027-1008-1012-1008"},{"status":"affected","version":"1027-1008-1013-1008"},{"status":"affected","version":"1027-1014-1015-1009"},{"status":"affected","version":"1027L-1006L-1015L-1009L"},{"status":"affected","version":"1028-1007-1014-1012"},{"status":"affected","version":"1029-1007-1014-1008"},{"status":"affected","version":"1030-1007-1014-1012"},{"status":"affected","version":"1030-1008-1014-1008"},{"status":"affected","version":"1031-1007-1015-1012"},{"status":"affected","version":"1032-1007-1015-1008"},{"status":"affected","version":"1032k-1007k-1015k-1008k"},{"status":"affected","version":"1036r-1008r-1016r-1009r"},{"status":"affected","version":"1037-1008-1017-1009"},{"status":"affected","version":"S749-S749-S749-S749"},{"status":"affected","version":"S820-S820-S820-S820"},{"status":"affected","version":"S823-S823-S823-S823"},{"status":"affected","version":"S855-S855-S855-S855"},{"status":"affected","version":"S914V-S914V-S914V-S914V"},{"status":"affected","version":"S968-S968-S968-S968"},{"status":"affected","version":"S984-S984-S984-S984"},{"status":"affected","version":"T717-T717-T717-T717"}]}],"credits":[{"lang":"en","type":"finder","value":"Gergely Eberhardt (SEARCH-LAB.hu)"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"An OS command injection vulnerability exists in AVTECH DVR, NVR, and IP camera devices within the <code>adcommand.cgi</code> endpoint, which interfaces with the ActionD daemon. Authenticated users can invoke the <code>DoShellCmd</code> operation, passing arbitrary input via the <code>strCmd</code> parameter. This input is executed directly by the system shell without sanitation allowing attackers to execute commands as the root user."}],"value":"An OS command injection vulnerability exists in AVTECH DVR, NVR, and IP camera devices within the adcommand.cgi endpoint, which interfaces with the ActionD daemon. Authenticated users can invoke the DoShellCmd operation, passing arbitrary input via the strCmd parameter. This input is executed directly by the system shell without sanitation allowing attackers to execute commands as the root user."}],"impacts":[{"capecId":"CAPEC-88","descriptions":[{"lang":"en","value":"CAPEC-88 OS Command Injection"}]},{"capecId":"CAPEC-137","descriptions":[{"lang":"en","value":"CAPEC-137 Parameter Injection"}]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":9.4,"baseSeverity":"CRITICAL","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","description":"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-20","description":"CWE-20 Improper Input Validation","lang":"en","type":"CWE"}]}],"providerMetadata":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-04-07T14:09:16.960Z"},"references":[{"tags":["exploit"],"url":"https://www.exploit-db.com/exploits/40500"},{"tags":["product"],"url":"https://avtech.com/"},{"tags":["third-party-advisory","technical-description"],"url":"https://web.archive.org/web/20240810225729/https://www.search-lab.hu/advisories/126-AVTech-devices-multiple-vulnerabilities"},{"tags":["exploit"],"url":"https://web.archive.org/web/20161029201749/https://github.com/ebux/AVTECH"},{"tags":["third-party-advisory"],"url":"https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns"}],"source":{"discovery":"UNKNOWN"},"title":"AVTECH IP camera, DVR, and NVR Devices Authenticated Root Command Execution","x_generator":{"engine":"Vulnogram 0.2.0"},"datePublic":"2016-10-11T00:00:00.000Z"},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-07-01T18:33:10.541355Z","id":"CVE-2025-34055","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-07-01T18:33:20.804Z"}}]}}