Vulnerability in Avtech Dvr Devices
CVE-2025-34066
An improper certificate validation vulnerability exists in AVTECH IP cameras, DVRs, and NVRs due to the use of wget with --no-check-certificate in scripts like SyncCloudAccount.sh and SyncPermit.sh. This exposes HTTPS communications to man-in-the-middle (MITM) attacks.
Vulnerability class: Improper Certificate Validation
EPSS: 0.003 (18.9th percentile) — read the EPSS interpretation.
Affected products
- Avtech Dvr Devices — versions 0
- Avtech Ip Cameras — versions 0
- Avtech Nvr Devices — versions 0
Weakness classification (CWE)
References
- disclosure@vulncheck.com (exploit)
- disclosure@vulncheck.com (product)
- disclosure@vulncheck.com (technical-description, third-party-advisory)
- disclosure@vulncheck.com (exploit)
- disclosure@vulncheck.com (third-party-advisory)