{"id":"CVE-2025-34050","state":"PUBLISHED","title":"AVTECH IP Camera, DVR, and NVR Devices Cross-Site Request Forgery","description":"A cross-site request forgery (CSRF) vulnerability exists in the web interface of AVTECH IP camera, DVR, and NVR devices. An attacker can craft malicious requests that, when executed in the context of an authenticated user’s browser session, allow unauthorized changes to the device configuration without user interaction.","publishedAt":"2025-07-01T14:42:57.143Z","updatedAt":"2026-04-07T14:09:13.996Z","severity":{"score":5.1,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["AVTECH IP cameras","AVTECH DVR devices","AVTECH NVR devices"],"affected":[{"vendor":"AVTECH","product":"IP cameras","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected"}],"modules":["Web Management Interface (configuration endpoints)"]},{"vendor":"AVTECH","product":"DVR devices","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected"}],"modules":["Web Management Interface (configuration endpoints)"]},{"vendor":"AVTECH","product":"NVR devices","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected"}],"modules":["Web Management Interface (configuration endpoints)"]}],"references":["https://www.exploit-db.com/exploits/40500","https://avtech.com/","https://web.archive.org/web/20240810225729/https://www.search-lab.hu/advisories/126-AVTech-devices-multiple-vulnerabilities","https://web.archive.org/web/20161029201749/https://github.com/ebux/AVTECH","https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns"],"weaknesses":["CWE-352"],"ingestedAt":"2026-10-29T20:09:03.054Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/34xxx/CVE-2025-34050.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-34050","state":"PUBLISHED","datePublished":"2025-07-01T14:42:57.143Z","dateUpdated":"2026-04-07T14:09:13.996Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2025-04-15T19:15:22.548Z"},"containers":{"cna":{"title":"AVTECH IP Camera, DVR, and NVR Devices Cross-Site Request Forgery","descriptions":[{"lang":"en","value":"A cross-site request forgery (CSRF) vulnerability exists in the web interface of AVTECH IP camera, DVR, and NVR devices. An attacker can craft malicious requests that, when executed in the context of an authenticated user’s browser session, allow unauthorized changes to the device configuration without user interaction."}],"affected":[{"vendor":"AVTECH","product":"IP cameras","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected"}],"modules":["Web Management Interface (configuration endpoints)"]},{"vendor":"AVTECH","product":"DVR devices","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected"}],"modules":["Web Management Interface (configuration endpoints)"]},{"vendor":"AVTECH","product":"NVR devices","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected"}],"modules":["Web Management Interface (configuration endpoints)"]}],"references":[{"url":"https://www.exploit-db.com/exploits/40500","tags":["exploit"]},{"url":"https://avtech.com/","tags":["product"]},{"url":"https://web.archive.org/web/20240810225729/https://www.search-lab.hu/advisories/126-AVTech-devices-multiple-vulnerabilities","tags":["third-party-advisory","technical-description"]},{"url":"https://web.archive.org/web/20161029201749/https://github.com/ebux/AVTECH","tags":["exploit"]},{"url":"https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":5.1,"baseSeverity":"MEDIUM","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-352","description":"CWE-352 Cross-Site Request Forgery (CSRF)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-04-07T14:09:13.996Z"},"credits":[{"lang":"en","type":"finder","value":"Gergely Eberhardt (SEARCH-LAB.hu)"}],"impacts":[{"capecId":"CAPEC-62","descriptions":[{"lang":"en","value":"CAPEC-62 Cross Site Request Forgery"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"},"datePublic":"2016-10-11T00:00:00.000Z"},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-07-01T18:44:55.395830Z","id":"CVE-2025-34050","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-07-01T18:45:06.703Z"}}]}}}