AVTECH IP cameras, AVTECH DVRs, and AVTECH NVRs have security vulnerabilities

AVTECH IP camera and others are products of AVTECH Corporation, U.S.A. AVTECH IP camera is a series of network security cameras.AVTECH DVR is a digital video recording host.AVTECH NVR is a network video recorder. A security vulnerability exists in AVTECH IP camera, AVTECH DVR, and AVTECH NVR that...

Number withdrawal

AVTECH IP camera and others are products of AVTECH Corporation.AVTECH IP camera is a series of network security cameras.AVTECH DVR is a digital video recording host.AVTECH NVR is a network video recorder. This CVE number has been withdrawn...

AVTECH IP cameras, AVTECH DVRs, and AVTECH NVRs have security vulnerabilities

AVTECH IP camera and others are products of AVTECH Corporation, USA.AVTECH IP camera is a series of network security cameras.AVTECH DVR is a digital video recording host.AVTECH NVR is a network video recorder. A security vulnerability exists in AVTECH IP camera, AVTECH DVR, and AVTECH NVR that...

AVTECH IP cameras, AVTECH DVRs, and AVTECH NVRs have security vulnerabilities

AVTECH IP camera and others are products of AVTECH Corporation, USA.AVTECH IP camera is a series of network security cameras.AVTECH DVR is a digital video recording host.AVTECH NVR is a network video recorder. A security vulnerability exists in AVTECH IP camera, AVTECH DVR and AVTECH NVR that ste...

CVE-2025-34065: Authentication Bypass by Spoofing

An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr function allows unauthenticated access to any request containing "/nobody" in the URL, bypassing login controls...

CVE-2025-34050: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability exists in the web interface of AVTECH IP camera, DVR, and NVR devices. An attacker can craft malicious requests that, when executed in the context of an authenticated user’s browser session, allow unauthorized changes to the device configuration...

CVE-2025-34053: Authentication Bypass by Spoofing

An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr function is used to identify ".cab" requests, allowing any URL containing ".cab" to bypass authentication and access protected endpoints...

CVE-2025-34056: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability exists in AVTECH IP camera, DVR, and NVR devices via the PwdGrp.cgi endpoint, which handles user and group management operations. Authenticated users can supply input through the pwd or grp parameters, which are directly embedded into system commands without...

CVE-2025-34055: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability exists in AVTECH DVR, NVR, and IP camera devices within the adcommand.cgi endpoint, which interfaces with the ActionD daemon. Authenticated users can invoke the DoShellCmd operation, passing arbitrary input via the strCmd parameter. This input is executed...

AVTECH IP cameras, AVTECH DVRs, and AVTECH NVRs have security vulnerabilities

AVTECH IP camera and others are products of AVTECH Corporation, USA.AVTECH IP camera is a series of network security cameras.AVTECH DVR is a digital video recording host.AVTECH NVR is a network video recorder. A security vulnerability exists in AVTECH IP camera, AVTECH DVR and AVTECH NVR that...

A week in security (June 23 – June 29)

Last week on Malwarebytes Labs: Gmail’s multi-factor authentication bypassed by hackers to pull off targeted attacks Thousands of private camera feeds found online. Make sure yours isn’t one of them Sextortion email scammers increase their "Hello pervert" money demands Many data brokers are faili...

D-Link Multiple DCS IP Camera Devices Multiple Vulnerabilities (SAP10247)

Multiple D-Link DCS IP camera devices are prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-34042

An authenticated command injection vulnerability exists in the Beward N100 IP Camera firmware version M2.1.6.04C014 via the ServerName and TimeZone parameters in the servetest CGI page. An attacker with access to the web interface can inject arbitrary system commands into these parameters, which...

CVE-2025-34042

CVE-2025-34042 describes an authenticated command-injection vulnerability in Beward N100 IP Camera firmware version M2.1.6.04C014. The issue stems from unsafely embedded ServerName and TimeZone parameters in the servetest CGI page, allowing an authenticated attacker with web-interface access to i...

CVE-2025-34042 Beward N100 IP Camera Remote Command Execution

An authenticated command injection vulnerability exists in the Beward N100 IP Camera firmware version M2.1.6.04C014 via the ServerName and TimeZone parameters in the servetest CGI page. An attacker with access to the web interface can inject arbitrary system commands into these parameters, which...

CVE-2025-34042 Beward N100 IP Camera Remote Command Execution

An authenticated command injection vulnerability exists in the Beward N100 IP Camera firmware version M2.1.6.04C014 via the ServerName and TimeZone parameters in the servetest CGI page. An attacker with access to the web interface can inject arbitrary system commands into these parameters, which...

Beward N100 IP Camera security vulnerability

Beward N100 IP Camera is an open source camera from Beward, Russia. A security vulnerability exists in Beward N100 IP Camera version M2.1.6.04C014, which is caused by incorrect manipulation of the ServerName and TimeZone parameters in the servetest CGI page, resulting in a command injection attac...

PT-2025-26991

Name of the Vulnerable Software and Affected Versions Beward N100 IP Camera version M2.1.6.04C014 Description An authenticated command injection issue exists in the Beward N100 IP Camera firmware. An attacker with web interface access can inject arbitrary system commands through the ServerName an...

CVE-2025-34042: Improper Neutralization of Special Elements used in an OS Command

An authenticated command injection vulnerability exists in the Beward N100 IP Camera firmware version M2.1.6.04C014 via the ServerName and TimeZone parameters in the servetest CGI page. An attacker with access to the web interface can inject arbitrary system commands into these parameters, which...

D-Link DCS IP Camera Devices Detection Consolidation

Consolidation of D-Link DCS IP camera devices. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only include"pluginfeedinfo.inc"; ifdescription...