CVE-2025-34051

MediumCVSS 6.9/10Last modified Jun 17, 2026

Description

A server-side request forgery vulnerability exists in multiple firmware versions of AVTECH DVR devices that exposes the /cgi-bin/nobody/Search.cgi?action=cgi_query endpoint without authentication. An attacker can manipulate the ip, port, and queryb64str parameters to make arbitrary HTTP requests from the DVR to internal or external systems, potentially exposing sensitive data or interacting with internal services.

Metrics

CVSS 4.0 6.9/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-200 CWE-918

Affected software

Vendor	Product	Versions
AVTECH	DVR devices	1001-1000-1000-1000; 1001-1000-1001-1001; 1002-1000-1002-1001; 1002-1001-1001-1001; 1004-1002-1001-1000; 1004-1002-1003-1000-FFFF; 1004V-1002V-1003V-1001V; 1004Y-1002Y-1001EJ-1000Y; 1004Y-1002Y-1001Y-1000Y; 1005-1002-1002-1000; 1005-1002-1004-1001; 1006-1001-1003-1004; 1006-1002-1003-1000; 1006Y-1002Y-1003Y-1000Y; 1007-1002-1004-1000; 1007-1003-1003-1002; 1007-1003-1005-1001; 1007E-1003E-1005EJ-1001E; 1007V-1003V-1005V-1001V; 1007Y-1002Y-1004Y-1000Y

References

Timeline

Published: Jul 1, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-340536.9An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr() function is used t CVE-2025-3405410.0An unauthenticated command injection vulnerability exists in AVTECH DVR devices via Search.cgi?action=cgi_query. The use of wget without inp CVE-2025-340559.4An OS command injection vulnerability exists in AVTECH DVR, NVR, and IP camera devices within the adcommand.cgi endpoint, which interfaces w CVE-2025-340569.4An OS command injection vulnerability exists in AVTECH IP camera, DVR, and NVR devices via the PwdGrp.cgi endpoint, which handles user and g CVE-2025-340578.7An information disclosure vulnerability exists in Ruijie NBR series routers (known to affect NBR2000G, NBR1300G, and NBR1000 models) via the CVE-2025-340588.7Hikvision Streaming Media Management Server v2.3.5 uses default credentials that allow remote attackers to authenticate and access restricte CVE-2025-340598.7An SQL injection vulnerability exists in the Dahua Smart Cloud Gateway Registration Management Platform via the username parameter in the /i CVE-2025-34066.5A vulnerability was found in Nothings stb up to f056911. It has been classified as problematic. Affected is the function stbhw_build_tileset CVE-2025-3406010.0A PHP objection injection vulnerability exists in the Monero Project’s Laravel-based forum software due to unsafe handling of untrusted inpu CVE-2025-340619.3A backdoor in PHPStudy versions 2016 through 2018 allows unauthenticated remote attackers to execute arbitrary PHP code on affected installa CVE-2025-340625.7An information disclosure vulnerability exists in OneLogin AD Connector versions prior to 6.1.5 via the /api/adc/v4/configuration endpoint. CVE-2025-3406310.0A cryptographic authentication bypass vulnerability exists in OneLogin AD Connector prior to 6.1.5 due to the exposure of a tenant’s SSO JWT