CVE-2025-34056: AVTECH IP camera, DVR, and NVR Devices Authenticated Root Command Execution

Published Jul 1, 2025

Updated

An OS command injection vulnerability exists in AVTECH IP camera, DVR, and NVR devices via the PwdGrp.cgi endpoint, which handles user and group management operations. Authenticated users can supply input through the pwd or grp parameters, which are directly embedded into system commands without proper sanitation. This allows for the execution of arbitrary shell commands with root privileges.

Affected Software

3 affected components

AVTECH IP camera

AVTECH DVR

AVTECH NVR

Event History

Jul 1, 2025

CVE Published

via MITRE·02:46 PM

Data Sourced

via MITRE·02:46 PM

DescriptionWeakness

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-34056?

The CVE-2025-34056 vulnerability has a high severity rating due to its potential for OS command injection.

How do I fix CVE-2025-34056?

To fix CVE-2025-34056, ensure that you are using the latest firmware updates provided by AVTECH for affected devices.

Who is affected by CVE-2025-34056?

CVE-2025-34056 affects users of AVTECH IP cameras, DVRs, and NVRs that utilize the PwdGrp.cgi endpoint.

What are the risks associated with CVE-2025-34056?

The risks associated with CVE-2025-34056 include unauthorized execution of commands on the underlying operating system by authenticated users.

Is authentication required to exploit CVE-2025-34056?

Yes, exploitation of CVE-2025-34056 requires authentication as it affects the PwdGrp.cgi endpoint accessible to logged-in users.