CVE-2025-34036

🗓️ 24 Jun 2025 01:00:52Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 38 Views🌐 WEB

Remote command injection in Shenzhen TVT DVRs due to unsanitized URI path in HTTP service.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2025-34036	24 Jun 202504:31	–	circl
CNNVD	TVT DVR 操作系统命令注入漏洞	24 Jun 202500:00	–	cnnvd
Cvelist	CVE-2025-34036 Shenzhen TVT CCTV-DVR Command Injection	24 Jun 202501:00	–	cvelist
GithubExploit	Exploit for Improper Input Validation in Tvt Td-2108Ts-Cl_Firmware	20 Aug 202507:37	–	githubexploit
EUVD	EUVD-2025-18965	3 Oct 202520:07	–	euvd
NVD	CVE-2025-34036	24 Jun 202501:15	–	nvd
Positive Technologies	PT-2025-26663	24 Jun 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-34036	26 Jun 202503:12	–	redhatcve
VulnCheck KEV	VulnCheck KEV: CVE-2025-34036	23 Jun 202500:00	–	vulncheck_kev
Vulnrichment	CVE-2025-34036 Shenzhen TVT CCTV-DVR Command Injection	24 Jun 202501:00	–	vulnrichment

NVD

Vulners

Node

tvt td-2108ts-cl_firmwareMatch-

AND

tvt td-2108ts-clMatch-

Node

tvt td-2108ts-cl-a_firmwareMatch-

AND

tvt td-2108ts-cl-aMatch-

Node

tvt td-2116ts-cl_firmwareMatch-

AND

tvt td-2116ts-clMatch-

Node

tvt td-2104ts-hc_firmwareMatch-

AND

tvt td-2104ts-hcMatch-

Node

tvt td-2108ts-hc_firmwareMatch-

AND

tvt td-2108ts-hcMatch-

Node

tvt td-2116ts-hc_firmwareMatch-

AND

tvt td-2116ts-hcMatch-

Node

tvt td-2104ts-hp_firmwareMatch-

AND

tvt td-2104ts-hpMatch-

Node

tvt td-2108ts-hp_firmwareMatch-

AND

tvt td-2108ts-hpMatch-

Node

tvt td-2116te-hp_firmwareMatch-

AND

tvt td-2116te-hpMatch-

Node

tvt td-2704ts-hc_firmwareMatch-

AND

tvt td-2704ts-hcMatch-

Node

tvt td-2708ts-hc_firmwareMatch-

AND

tvt td-2708ts-hcMatch-

Node

tvt td-2716te-hc_firmwareMatch-

AND

tvt td-2716te-hcMatch-

Node

tvt td-2716te-hc-a_firmwareMatch-

AND

tvt td-2716te-hc-aMatch-

Node

tvt td-2716tc-hc_firmwareMatch-

AND

tvt td-2716tc-hcMatch-

Node

tvt td-2732tc-hc_firmwareMatch-

AND

tvt td-2732tc-hcMatch-

Node

tvt td-2716td-hc_firmwareMatch-

AND

tvt td-2716td-hcMatch-

Node

tvt td-2732td-hc_firmwareMatch-

AND

tvt td-2732td-hcMatch-

Node

tvt td-2704ts-hp_firmwareMatch-

AND

tvt td-2704ts-hpMatch-

Node

tvt td-2708ts-hp_firmwareMatch-

AND

tvt td-2708ts-hpMatch-

Node

tvt td-2708te-hp_firmwareMatch-

AND

tvt td-2708te-hpMatch-

Node

tvt td-2716te-hp_firmwareMatch-

AND

tvt td-2716te-hpMatch-

Node

tvt td-2716te-hp-a_firmwareMatch-

AND

tvt td-2716te-hp-aMatch-

Node

tvt td-2716tc-hp_firmwareMatch-

AND

tvt td-2716tc-hpMatch-

Node

tvt td-2708te-hk_firmwareMatch-

AND

tvt td-2708te-hkMatch-

Node

tvt td-2932td-hp_firmwareMatch-

AND

tvt td-2932td-hpMatch-

Node

tvt td-2004ts-cl_firmwareMatch-

AND

tvt td-2004ts-clMatch-

Node

tvt td-2004ts-cl-c_firmwareMatch-

AND

tvt td-2004ts-cl-cMatch-

Node

tvt td-2104ts-cl_firmwareMatch-

AND

tvt td-2104ts-clMatch-

Node

tvt td-2104ts-cl-a_firmwareMatch-

AND

tvt td-2104ts-cl-aMatch-

Node

tvt td-2008ts-cl_firmwareMatch-

AND

tvt td-2008ts-clMatch-

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "Web Management Interface (language localization handler in HTTP server binary td3520a)"
    ],
    "product": "CCTV-DVR",
    "vendor": "Shenzhen TVT",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
web	www.web.archive.org/web/20160322204109/http://www.kerneronsec.com/2016/02/remote-code-execution-in-cctv-dvrs-of.html
exploit-db	www.exploit-db.com/exploits/39596
vulncheck	www.vulncheck.com/advisories/shenzhen-tvt-cctv-dvr-command-injection

Parameter	Position	Path	Description	CWE
lang	path	/language/[lang]/index.html	OS command injection via unsafely used [lang] in tar extraction during /language/[lang]/index.html processing, enabling remote code execution as root.	CWE-78

07 Apr 2026 14:09Current

7.7High risk

Vulners AI Score7.7

CVSS 3.19.8

CVSS 410

EPSS0.1933

SSVC