The vulnerability of the DoShellCmd() function in the ActionD daemon of the Avtech microprogramming system for IP cameras and digital/network video recorders allows a violator to execute arbitrary code.

The vulnerability of the DoShellCmd function in the ActionD daemon of Avtech’s microprogramming software for IP cameras and digital/netscreen video recorders lies in insufficient validation of input data during the processing of the strCmd parameter. Exploiting this vulnerability allows a remote...

CVE-2025-34055

An OS command injection vulnerability exists in AVTECH DVR, NVR, and IP camera devices within the adcommand.cgi endpoint, which interfaces with the ActionD daemon. Authenticated users can invoke the DoShellCmd operation, passing arbitrary input via the strCmd parameter. This input is executed...

CVE-2025-34055

An OS command injection vulnerability exists in AVTECH DVR, NVR, and IP camera devices within the adcommand.cgi endpoint, which interfaces with the ActionD daemon. Authenticated users can invoke the DoShellCmd operation, passing arbitrary input via the strCmd parameter. This input is executed...

CVE-2025-34055: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability exists in AVTECH DVR, NVR, and IP camera devices within the adcommand.cgi endpoint, which interfaces with the ActionD daemon. Authenticated users can invoke the DoShellCmd operation, passing arbitrary input via the strCmd parameter. This input is executed...

Authentication Command Injection Vulnerability in adcommand.cgi for AVTECH Devices

AVTECH, founded in 1996, is one of the world's leading CCTV manufacturers. The main products are surveillance equipment, network cameras, network video recorders and so on. An authenticated command injection vulnerability exists in the AVTECH device adcommand.cgi.Avtech devices contain the...