{"id":"CVE-2025-34056","state":"PUBLISHED","title":"AVTECH IP camera, DVR, and NVR Devices Authenticated Root Command Execution","description":"An OS command injection vulnerability exists in AVTECH IP camera, DVR, and NVR devices via the PwdGrp.cgi endpoint, which handles user and group management operations. Authenticated users can supply input through the pwd or grp parameters, which are directly embedded into system commands without proper sanitation. This allows for the execution of arbitrary shell commands with root privileges.","publishedAt":"2025-07-01T14:46:52.800Z","updatedAt":"2026-04-07T14:09:17.710Z","severity":{"score":9.4,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","source":"VulnCheck"},"assigner":"VulnCheck","products":["AVTECH IP camera, DVR, and NVR Devices"],"affected":[{"vendor":"AVTECH","product":"IP camera, DVR, and NVR Devices","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected"}],"modules":["PwdGrp.cgi user/group configuration handler","pwd parameter","grp parameter"]}],"references":["https://www.exploit-db.com/exploits/40500","https://avtech.com/","https://web.archive.org/web/20240810225729/https://www.search-lab.hu/advisories/126-AVTech-devices-multiple-vulnerabilities","https://web.archive.org/web/20161029201749/https://github.com/ebux/AVTECH","https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns"],"weaknesses":["CWE-78","CWE-20"],"ingestedAt":"2026-10-29T20:09:03.054Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/34xxx/CVE-2025-34056.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-34056","state":"PUBLISHED","datePublished":"2025-07-01T14:46:52.800Z","dateUpdated":"2026-04-07T14:09:17.710Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2025-04-15T19:15:22.549Z"},"containers":{"cna":{"title":"AVTECH IP camera, DVR, and NVR Devices Authenticated Root Command Execution","descriptions":[{"lang":"en","value":"An OS command injection vulnerability exists in AVTECH IP camera, DVR, and NVR devices via the PwdGrp.cgi endpoint, which handles user and group management operations. Authenticated users can supply input through the pwd or grp parameters, which are directly embedded into system commands without proper sanitation. This allows for the execution of arbitrary shell commands with root privileges."}],"affected":[{"vendor":"AVTECH","product":"IP camera, DVR, and NVR Devices","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected"}],"modules":["PwdGrp.cgi user/group configuration handler","pwd parameter","grp parameter"]}],"references":[{"url":"https://www.exploit-db.com/exploits/40500","tags":["exploit"]},{"url":"https://avtech.com/","tags":["product"]},{"url":"https://web.archive.org/web/20240810225729/https://www.search-lab.hu/advisories/126-AVTech-devices-multiple-vulnerabilities","tags":["third-party-advisory","technical-description"]},{"url":"https://web.archive.org/web/20161029201749/https://github.com/ebux/AVTECH","tags":["exploit"]},{"url":"https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":9.4,"baseSeverity":"CRITICAL","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","description":"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-20","description":"CWE-20 Improper Input Validation","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-04-07T14:09:17.710Z"},"credits":[{"lang":"en","type":"finder","value":"Gergely Eberhardt (SEARCH-LAB.hu)"}],"impacts":[{"capecId":"CAPEC-88","descriptions":[{"lang":"en","value":"CAPEC-88 OS Command Injection"}]},{"capecId":"CAPEC-137","descriptions":[{"lang":"en","value":"CAPEC-137 Parameter Injection"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"},"datePublic":"2016-10-11T00:00:00.000Z"},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-07-01T18:34:24.733333Z","id":"CVE-2025-34056","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-07-01T18:34:41.482Z"}}]}}}