CVE-2025-34056

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-34056", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2025-04-15T19:15:22.549Z", "datePublished": "2025-07-01T14:46:52.800Z", "dateUpdated": "2026-04-07T14:09:17.710Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["PwdGrp.cgi user/group configuration handler", "pwd parameter", "grp parameter"], "product": "IP camera, DVR, and NVR Devices", "vendor": "AVTECH", "versions": [{"status": "affected", "version": "0"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Gergely Eberhardt (SEARCH-LAB.hu)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "An OS command injection vulnerability exists in AVTECH IP camera, DVR, and NVR devices via the <code>PwdGrp.cgi</code> endpoint, which handles user and group management operations. Authenticated users can supply input through the <code>pwd</code> or <code>grp</code> parameters, which are directly embedded into system commands without proper sanitation. This allows for the execution of arbitrary shell commands with root privileges."}], "value": "An OS command injection vulnerability exists in AVTECH IP camera, DVR, and NVR devices via the PwdGrp.cgi endpoint, which handles user and group management operations. Authenticated users can supply input through the pwd or grp parameters, which are directly embedded into system commands without proper sanitation. This allows for the execution of arbitrary shell commands with root privileges."}], "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88 OS Command Injection"}]}, {"capecId": "CAPEC-137", "descriptions": [{"lang": "en", "value": "CAPEC-137 Parameter Injection"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-04-07T14:09:17.710Z"}, "references": [{"tags": ["exploit"], "url": "https://www.exploit-db.com/exploits/40500"}, {"tags": ["product"], "url": "https://avtech.com/"}, {"tags": ["third-party-advisory", "technical-description"], "url": "https://web.archive.org/web/20240810225729/https://www.search-lab.hu/advisories/126-AVTech-devices-multiple-vulnerabilities"}, {"tags": ["exploit"], "url": "https://web.archive.org/web/20161029201749/https://github.com/ebux/AVTECH"}, {"tags": ["third-party-advisory"], "url": "https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns"}], "source": {"discovery": "UNKNOWN"}, "title": "AVTECH IP camera, DVR, and NVR Devices Authenticated Root Command Execution", "x_generator": {"engine": "Vulnogram 0.2.0"}, "datePublic": "2016-10-11T00:00:00.000Z"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-01T18:34:24.733333Z", "id": "CVE-2025-34056", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-01T18:34:41.482Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-34056", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-07-01T18:34:24.733333Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-01T18:34:35.332Z"}}], "cna": {"title": "AVTECH IP camera, DVR, and NVR Devices Authenticated Root Command Execution", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Gergely Eberhardt (SEARCH-LAB.hu)"}], "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88 OS Command Injection"}]}, {"capecId": "CAPEC-137", "descriptions": [{"lang": "en", "value": "CAPEC-137 Parameter Injection"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.4, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "AVTECH", "modules": ["PwdGrp.cgi user/group configuration handler", "pwd parameter", "grp parameter"], "product": "IP camera, DVR, and NVR Devices", "versions": [{"status": "affected", "version": "0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.exploit-db.com/exploits/40500", "tags": ["exploit"]}, {"url": "https://avtech.com/", "tags": ["product"]}, {"url": "https://web.archive.org/web/20240810225729/https://www.search-lab.hu/advisories/126-AVTech-devices-multiple-vulnerabilities", "tags": ["third-party-advisory", "technical-description"]}, {"url": "https://web.archive.org/web/20161029201749/https://github.com/ebux/AVTECH", "tags": ["exploit"]}, {"url": "https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "An OS command injection vulnerability exists in AVTECH IP camera, DVR, and NVR devices via the PwdGrp.cgi endpoint, which handles user and group management operations. Authenticated users can supply input through the pwd or grp parameters, which are directly embedded into system commands without proper sanitation. This allows for the execution of arbitrary shell commands with root privileges.", "supportingMedia": [{"type": "text/html", "value": "An OS command injection vulnerability exists in AVTECH IP camera, DVR, and NVR devices via the <code>PwdGrp.cgi</code> endpoint, which handles user and group management operations. Authenticated users can supply input through the <code>pwd</code> or <code>grp</code> parameters, which are directly embedded into system commands without proper sanitation. This allows for the execution of arbitrary shell commands with root privileges.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2025-07-01T14:46:52.800Z"}}}, "cveMetadata": {"cveId": "CVE-2025-34056", "state": "PUBLISHED", "dateUpdated": "2025-07-01T18:34:41.482Z", "dateReserved": "2025-04-15T19:15:22.549Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2025-07-01T14:46:52.800Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["PwdGrp.cgi user/group configuration handler", "pwd parameter", "grp parameter"], "product": "IP camera, DVR, and NVR Devices", "vendor": "AVTECH", "versions": [{"status": "affected", "version": "0"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An OS command injection vulnerability exists in AVTECH IP camera, DVR, and NVR devices via the PwdGrp.cgi endpoint, which handles user and group management operations. Authenticated users can supply input through the pwd or grp parameters, which are directly embedded into system commands without proper sanitation. This allows for the execution of arbitrary shell commands with root privileges."}, {"lang": "es", "value": "Existe una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo en AVTECH IP camera, DVR, y NVR a trav\u00e9s del endpoint PwdGrp.cgi, que gestiona las operaciones de administraci\u00f3n de usuarios y grupos. Los usuarios autenticados pueden proporcionar informaci\u00f3n mediante los par\u00e1metros pwd o grp, que se integran directamente en los comandos del sistema sin la debida autorizaci\u00f3n. Esto permite la ejecuci\u00f3n de comandos de shell arbitrarios con privilegios de root."}], "id": "CVE-2025-34056", "lastModified": "2026-06-17T09:13:23.637", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-34056", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-07-01T18:34:24.733333Z", "version": "2.0.3"}}]}, "published": "2025-07-01T15:15:24.203", "references": [{"source": "disclosure@vulncheck.com", "url": "https://avtech.com/"}, {"source": "disclosure@vulncheck.com", "url": "https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns"}, {"source": "disclosure@vulncheck.com", "url": "https://web.archive.org/web/20161029201749/https://github.com/ebux/AVTECH"}, {"source": "disclosure@vulncheck.com", "url": "https://web.archive.org/web/20240810225729/https://www.search-lab.hu/advisories/126-AVTech-devices-multiple-vulnerabilities"}, {"source": "disclosure@vulncheck.com", "url": "https://www.exploit-db.com/exploits/40500"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-78"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-28T11:09:21.844804+00:00", "value": {"mitigation_remediation": ["Apply the latest firmware or security patch released by AVTECH that fixes the PwdGrp.cgi command injection flaw.", "Restrict network access to the PwdGrp.cgi endpoint by configuring firewall rules or VLAN segmentation so only trusted administrators can reach it.", "Disable or remove unnecessary administrative accounts and enforce least\u2011privilege policies so that only essential users can modify user or group settings."], "summary": {"action": "Immediate Patch", "impact": "Root\u2011level Remote Code Execution"}, "threat_synthesis": {"affected_systems": "AVTECH IP camera, DVR, and NVR devices are affected, but specific firmware or model versions are not disclosed in the advisory. The vulnerability impacts all devices that expose the PwdGrp.cgi interface to authenticated users. Since the advisory references multiple device types, it is reasonable to assume that all AVTECH surveillance and DVR/NVR platforms that use this CGI are at risk unless already upgraded.", "description_and_impact": "An OS command injection flaw exists in the PwdGrp.cgi endpoint of AVTECH IP camera, DVR, and NVR devices. The CGI accepts authenticated user input through the pwd and grp fields and concatenates it directly into system shell commands without any sanitization. This missing input validation allows an authenticated user to run arbitrary shell commands as if they were the root user. The flaw is a classic example of CWE\u201120 (Improper Input Validation) and CWE\u201178 (OS Command Injection).", "risk_and_exploitability": "The vulnerability carries a CVSS score of 9.4, indicating a high severity and a likely remote exploitation. The EPSS score is 2\u202f%, indicating a low probability of exploitation in the wild. The exploit requires authentication with privileges that allow access to the user/group management interface, so it is primarily an internal\u2011network or privileged\u2011account attack vector. It is not currently listed in the CISA KEV catalog, but once patched it should be reviewed. The attacker could achieve full control over the device, compromising confidentiality, integrity, and availability."}}}}, "created": "2026-04-28T11:15:26.095788+00:00", "updated": "2026-04-28T11:15:26.095799+00:00", "vendors": []}