CVE-2025-34055: AVTECH IP camera, DVR, and NVR Devices Authenticated Root Command Execution

Published Jul 1, 2025

Updated

An OS command injection vulnerability exists in AVTECH DVR, NVR, and IP camera devices within the adcommand.cgi endpoint, which interfaces with the ActionD daemon. Authenticated users can invoke the DoShellCmd operation, passing arbitrary input via the strCmd parameter. This input is executed directly by the system shell without sanitation allowing attackers to execute commands as the root user.

Affected Software

3 affected components

AVTECH DVR

AVTECH NVR

AVTECH IP camera

Event History

Jul 1, 2025

CVE Published

via MITRE·02:46 PM

Data Sourced

via MITRE·02:46 PM

DescriptionWeakness

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-34055?

CVE-2025-34055 is considered a high-severity vulnerability due to the potential for OS command injection.

How does CVE-2025-34055 affect AVTECH devices?

CVE-2025-34055 affects AVTECH DVR, NVR, and IP camera devices through the adcommand.cgi endpoint, allowing command execution via the DoShellCmd operation.

Who is affected by CVE-2025-34055?

Authenticated users of AVTECH DVR, NVR, and IP camera devices are affected by CVE-2025-34055.

What can be done to mitigate CVE-2025-34055?

To mitigate CVE-2025-34055, users should restrict access to the affected devices and apply any available firmware updates.

Is there a patch available for CVE-2025-34055?

Currently, AVTECH has not publicly released a patch specifically for CVE-2025-34055, so users should monitor for updates.