RCE in TP-Link Systems Inc. Vigi Nvr1104h-4p V1
CVE-2025-7723
A command injection vulnerability exists that can be exploited after authentication in VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2.This issue affects VIGI NVR1104H-4P V1: before 1.1.5 Build 250518; VIGI NVR2016H-16MP V2: before 1.3.1 Build 250407.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.008 (53.5th percentile) — read the EPSS interpretation.
Affected products
- Tp-link Systems Inc. Vigi Nvr1104h-4p V1 — versions 0
- Tp-link Systems Inc. Vigi Nvr2016h-16mp V2 — versions 0
Weakness classification (CWE)
References
- f23511db-6c3e-4e32-a477-6aa17d310630 (vendor-advisory)
- f23511db-6c3e-4e32-a477-6aa17d310630 (patch)
- f23511db-6c3e-4e32-a477-6aa17d310630 (patch)