Vulnerability in Avtech Ip Camera, Dvr, And Nvr Devices
CVE-2025-34053
An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr() function is used to identify ".cab" requests, allowing any URL containing ".cab" to bypass authentication and access protected endpoints.
EPSS: 0.005 (42.8th percentile) — read the EPSS interpretation.
Affected products
- Avtech Ip Camera, Dvr, And Nvr Devices — versions 1000-1000-1000-1000, 1000C-1000C-1000C-1000C, 1001-1000-1000-1000
Weakness classification (CWE)
References
- disclosure@vulncheck.com (exploit)
- disclosure@vulncheck.com (product)
- disclosure@vulncheck.com (technical-description, third-party-advisory)
- disclosure@vulncheck.com (exploit)
- disclosure@vulncheck.com (third-party-advisory)