RCE in Avtech Ip Camera, Dvr, And Nvr Devices
CVE-2025-34055
An OS command injection vulnerability exists in AVTECH DVR, NVR, and IP camera devices within the adcommand.cgi endpoint, which interfaces with the ActionD daemon. Authenticated users can invoke the DoShellCmd operation, passing arbitrary input via the strCmd parameter. This input is executed directly by the system shell without sanitation allowing attackers to execute commands as the root user.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.015 (72.2th percentile) — read the EPSS interpretation.
Affected products
- Avtech Ip Camera, Dvr, And Nvr Devices — versions 1001-1000-1000-1000, 1002-1000-1000-1000, 1002-1001-1001-1001
Weakness classification (CWE)
Public proof-of-concept exploits
References
- disclosure@vulncheck.com (exploit)
- disclosure@vulncheck.com (product)
- disclosure@vulncheck.com (technical-description, third-party-advisory)
- disclosure@vulncheck.com (exploit)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2025-34055?
- CVE-2025-34055 is a vulnerability in Avtech Ip Camera, Dvr, And Nvr Devices, classified under Improper Input Validation. Published 2025-07-01.
- Is CVE-2025-34055 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.