CVE-2025-34065

MediumCVSS 6.9/10Last modified Jun 17, 2026

Description

An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr() function allows unauthenticated access to any request containing "/nobody" in the URL, bypassing login controls.

Metrics

CVSS 4.0 6.9/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-290

Affected software

Vendor	Product	Versions
AVTECH	IP camera, DVR, and NVR Devices	1000-1000-1000-1000; 1000C-1000C-1000C-1000C; 1001-1000-1000-1000; 1001-1001-1000-1000; 1002-1000-1000-1000; 1002-1002-1000-1002; 1002D-1000D-1000D-1000D; 1003-1000-1000-1001; 1003-1001-1001-1000; 1003-1002-1001-1000; 1004-1000-1000-1000; 1004-1001-1001-1001; 1004-1002-1000-1001; 1004-1003-1001-1002; 1004-1003-1002-1001; 1004A-1001A-1002A-1000A; 1005-1002-1001-1002; 1005-1003-1001-1002; 1005-1004-1002-1001; 1005A-1001A-1002A-1001A

References

Timeline

Published: Jul 1, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-340668.3An improper certificate validation vulnerability exists in AVTECH IP cameras, DVRs, and NVRs due to the use of wget with --no-check-certific CVE-2025-3406710.0An unauthenticated remote command execution vulnerability exists in the applyCT component of the Hikvision Integrated Security Management Pl CVE-2025-340689.3An unauthenticated remote command execution vulnerability exists in Samsung WLAN AP WEA453e firmware prior to version 5.2.4.T1 via improper CVE-2025-340699.8An authentication bypass vulnerability exists in GFI Kerio Control 9.4.5 due to insecure default proxy configuration and weak access control CVE-2025-34078.8A vulnerability was found in Nothings stb up to f056911. It has been declared as critical. Affected by this vulnerability is the function st CVE-2025-340709.8A missing authentication vulnerability in the GFIAgent component of GFI Kerio Control 9.4.5 allows unauthenticated remote attackers to perfo CVE-2025-340719.8A remote code execution vulnerability in GFI Kerio Control 9.4.5 allows attackers with administrative access to upload and execute arbitrary CVE-2025-340729.3A data exfiltration vulnerability exists in Anthropic’s deprecated Slack Model Context Protocol (MCP) Server via automatic link unfurling. W CVE-2025-3407310.0An unauthenticated command injection vulnerability exists in stamparm/maltrail (Maltrail) versions <=0.54. A remote attacker can execute arb CVE-2025-340749.4An authenticated remote code execution vulnerability exists in Lucee’s administrative interface due to insecure design in the scheduled task CVE-2025-340767.2An authenticated local file inclusion vulnerability exists in Microweber CMS versions <= 1.2.11 through misuse of the backup management API.CVE-2025-3407710.0An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impers