CVE-2026-34005

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2026-34005", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-03-25T05:22:12.479Z", "datePublished": "2026-03-29T17:02:15.445Z", "dateUpdated": "2026-03-30T14:19:23.210Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "modules": ["Sofia binary - hostname configuration handler"], "product": "DVR/NVR devices", "vendor": "Xiongmai", "versions": [{"status": "affected", "version": "4.03.R11", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "In Sofia on Xiongmai DVR/NVR (AHB7008T-MH-V2 and NBD7024H-P) 4.03.R11 devices, root OS command injection can occur via shell metacharacters in the HostName value via an authenticated DVRIP protocol (TCP port 34567) request to the NetWork.NetCommon configuration handler, because system() is used."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-29T17:09:28.999Z"}, "references": [{"url": "https://www.xiongmaitech.com"}, {"url": "https://uky007.github.io/CVE-2026-34005/"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-30T14:19:13.856503Z", "id": "CVE-2026-34005", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-30T14:19:23.210Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34005", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-30T14:19:13.856503Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-30T14:19:18.931Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Xiongmai", "modules": ["Sofia binary - hostname configuration handler"], "product": "DVR/NVR devices", "versions": [{"status": "affected", "version": "4.03.R11", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://www.xiongmaitech.com"}, {"url": "https://uky007.github.io/CVE-2026-34005/"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "In Sofia on Xiongmai DVR/NVR (AHB7008T-MH-V2 and NBD7024H-P) 4.03.R11 devices, root OS command injection can occur via shell metacharacters in the HostName value via an authenticated DVRIP protocol (TCP port 34567) request to the NetWork.NetCommon configuration handler, because system() is used."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-29T17:09:28.999Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34005", "state": "PUBLISHED", "dateUpdated": "2026-03-30T14:19:23.210Z", "dateReserved": "2026-03-25T05:22:12.479Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-03-29T17:02:15.445Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "modules": ["Sofia binary - hostname configuration handler"], "product": "DVR/NVR devices", "vendor": "Xiongmai", "versions": [{"status": "affected", "version": "4.03.R11", "versionType": "custom"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Sofia on Xiongmai DVR/NVR (AHB7008T-MH-V2 and NBD7024H-P) 4.03.R11 devices, root OS command injection can occur via shell metacharacters in the HostName value via an authenticated DVRIP protocol (TCP port 34567) request to the NetWork.NetCommon configuration handler, because system() is used."}, {"lang": "es", "value": "En dispositivos Xiongmai DVR/NVR (AHB7008T-MH-V2 y NBD7024H-P) 4.03.R11 de Sofia, puede ocurrir una inyecci\u00f3n de comandos del sistema operativo como root a trav\u00e9s de metacaracteres de shell en el valor HostName mediante una solicitud autenticada del protocolo DVRIP (protocolo TCP puerto 34567) al gestor de configuraci\u00f3n NetWork.NetCommon, porque se utiliza system()."}], "id": "CVE-2026-34005", "lastModified": "2026-06-17T10:38:26.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "cve@mitre.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34005", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-30T14:19:13.856503Z", "version": "2.0.3"}}]}, "published": "2026-03-29T17:16:44.257", "references": [{"source": "cve@mitre.org", "url": "https://uky007.github.io/CVE-2026-34005/"}, {"source": "cve@mitre.org", "url": "https://www.xiongmaitech.com"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.03.R11"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "DVR/NVR devices", "source": "cna", "vendor": "Xiongmai"}, "product": "dvr/nvr_devices", "vendor": "xiongmai"}], "created": "2026-03-29T20:31:17.459706+00:00", "title": "Root OS Command Injection via HostName on Xiongmai DVR/NVR", "updated": "2026-06-18T10:00:16.678039+00:00", "vendors": ["xiongmai", "xiongmai$PRODUCT$dvr/nvr_devices"]}