CVE-2025-34055: Avtech IP Camera, Dvr, And NVR Devices

Critical severity, CVSS 9.4. EPSS: 1.5% chance of exploitation in the next 30 days.

An OS command injection vulnerability exists in AVTECH DVR, NVR, and IP camera devices within the adcommand.cgi endpoint, which interfaces with the ActionD daemon. Authenticated users can invoke the DoShellCmd operation, passing arbitrary input via the strCmd parameter. This input is executed directly by the system shell without sanitation allowing attackers to execute commands as the root user.

Affected products

• Avtech IP Camera, Dvr, And NVR Devices: version 1001-1000-1000-1000 only; version 1002-1000-1000-1000 only; version 1002-1001-1001-1001 only; version 1003-1000-1001-1000 only; version 1003-1001-1001-1000 only; version 1003-1001-1001-1001 only; …

Published 2025-07-01. Last modified 2026-06-17.