CVE-2025-10264

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

Certain models of NVR developed by Digiever has an Exposure of Sensitive Information vulnerability, allowing unauthenticated remoter attackers to access the system configuration file and obtain plaintext credentials of the NVR and its connected cameras.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-497

Affected software

VendorProductVersions
DigieverDS-1200<= *.*.*.78
DigieverDS-2100 Pro<= *.*.*.78
DigieverDS-2100 Pro+<= *.*.*.78
DigieverDS-2100 UHD<= *.*.*.78
DigieverDS-2200 UHD<= *.*.*.78
DigieverDS-2200 UHD+<= *.*.*.78
DigieverDS-4200 Pro<= *.*.*.78
DigieverDS-4200 Pro+<= x.x.x.78
DigieverDS-4200 UHD<= x.x.x.78
DigieverDS-4200 UHD+<= x.x.x.78
DigieverDS-4100-RM<= x.x.x.78
DigieverDS-4200-RM Pro+<= x.x.x.78
DigieverDS-4200-RM UHD<= x.x.x.78
DigieverDS-8x00-RM Pro+<= x.x.x.78
DigieverDS-8x00-SRM Pro+<= x.x.x.78
DigieverDS-8x00-RM UHD<= x.x.x.78
DigieverDS-16x00-RM Pro+<= x.x.x.78
DigieverDS-16x00-RM UHD<= x.x.x.78

References

Timeline

Published
Sep 12, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-102658.8Certain models of NVR developed by Digiever has an OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbCVE-2025-102669.8NUP Pro developed by NewType Infortech has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL CVE-2025-102675.3NUP Portal developed by NewType Infortech has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly CVE-2025-102685.3The Printcart Web to Print Product Designer for WooCommerce WordPress plugin through 2.4.8 is vulnerable to path traversal which makes it poCVE-2025-102697.5The Spirit Framework plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.2.13. This makes it CVE-2025-102716.1A vulnerability was found in erjinzhi 10OA 1.0. This impacts an unknown function of the file /trial/mvc/finder. The manipulation of the arguCVE-2025-102726.1A vulnerability was determined in erjinzhi 10OA 1.0. Affected is an unknown function of the file /trial/mvc/catalogue. This manipulation of CVE-2025-102735.3A vulnerability was identified in erjinzhi 10OA 1.0. Affected by this vulnerability is an unknown functionality of the file /view/file.aspx.CVE-2025-102746.1A security flaw has been discovered in erjinzhi 10OA 1.0. Affected by this issue is some unknown functionality of the file /trial/mvc/item. CVE-2025-102758.8A weakness has been identified in YunaiV yudao-cloud up to 2025.09. This affects an unknown part of the file /crm/business/transfer. ExecutiCVE-2025-102768.8A security vulnerability has been detected in YunaiV ruoyi-vue-pro up to 2025.09. This vulnerability affects unknown code of the file /crm/cCVE-2025-102778.8A vulnerability was detected in YunaiV yudao-cloud up to 2025.09. This issue affects some unknown processing of the file /crm/receivable/sub