CVE-2025-34054
Published: 01 July 2025
Summary
CVE-2025-34054 is a critical-severity OS Command Injection (CWE-78) vulnerability in Avtech (inferred from references). Its CVSS base score is 10.0 (Critical).
Operationally, ranked in the top 14.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
An unauthenticated command injection vulnerability exists in AVTECH DVR devices through the Search.cgi?action=cgi_query endpoint. The flaw stems from unsanitized input passed to wget, enabling arbitrary shell command execution as root via the username or queryb64str parameters. It is tracked under CWE-78 and carries a CVSS 4.0 score of 10.0.
Remote attackers require no authentication or user interaction to exploit the issue and can achieve full system compromise. Evidence of active exploitation was recorded by the Shadowserver Foundation on 2025-01-04 UTC.
The listed references include the vendor site, a VulnCheck advisory, archived research from Search-Lab and GitHub, and an Exploit-DB entry, but provide no details on patches or specific mitigation steps. The EPSS score remains flat at a peak and current value of 0.0230 with no material increase observed.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-19644
Vulnerability details
An unauthenticated command injection vulnerability exists in AVTECH DVR devices via Search.cgi?action=cgi_query. The use of wget without input sanitization allows attackers to inject shell commands through the username or queryb64str parameters, executing commands as root. Exploitation evidence was observed by…
more
the Shadowserver Foundation on 2025-01-04 UTC.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.