CVE-2025-34066

HighCVSS 8.3/10Last modified Jun 17, 2026

Description

An improper certificate validation vulnerability exists in AVTECH IP cameras, DVRs, and NVRs due to the use of wget with --no-check-certificate in scripts like SyncCloudAccount.sh and SyncPermit.sh. This exposes HTTPS communications to man-in-the-middle (MITM) attacks.

Metrics

CVSS 4.0 8.3/10CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-295

Affected software

VendorProductVersions
AVTECHIP cameras0
AVTECHDVR devices0
AVTECHNVR devices0

References

Timeline

Published
Jul 1, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-3406710.0An unauthenticated remote command execution vulnerability exists in the applyCT component of the Hikvision Integrated Security Management PlCVE-2025-340689.3An unauthenticated remote command execution vulnerability exists in Samsung WLAN AP WEA453e firmware prior to version 5.2.4.T1 via improper CVE-2025-340699.8An authentication bypass vulnerability exists in GFI Kerio Control 9.4.5 due to insecure default proxy configuration and weak access controlCVE-2025-34078.8A vulnerability was found in Nothings stb up to f056911. It has been declared as critical. Affected by this vulnerability is the function stCVE-2025-340709.8A missing authentication vulnerability in the GFIAgent component of GFI Kerio Control 9.4.5 allows unauthenticated remote attackers to perfoCVE-2025-340719.8A remote code execution vulnerability in GFI Kerio Control 9.4.5 allows attackers with administrative access to upload and execute arbitraryCVE-2025-340729.3A data exfiltration vulnerability exists in Anthropic’s deprecated Slack Model Context Protocol (MCP) Server via automatic link unfurling. WCVE-2025-3407310.0An unauthenticated command injection vulnerability exists in stamparm/maltrail (Maltrail) versions <=0.54. A remote attacker can execute arbCVE-2025-340749.4An authenticated remote code execution vulnerability exists in Lucee’s administrative interface due to insecure design in the scheduled taskCVE-2025-340767.2An authenticated local file inclusion vulnerability exists in Microweber CMS versions <= 1.2.11 through misuse of the backup management API.CVE-2025-3407710.0An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersCVE-2025-340787.8A local privilege escalation vulnerability exists in NSClient++ 0.5.2.35 when both the web interface and ExternalScripts features are enable
CVE-2025-34066: High severity, CVSS 8.3 | Vulnix