CVE-2025-34055
Published: 01 July 2025
Summary
CVE-2025-34055 is a critical-severity Improper Input Validation (CWE-20) vulnerability in Avtech (inferred from references). Its CVSS base score is 9.4 (Critical).
Operationally, ranked in the top 16.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
An OS command injection vulnerability exists in AVTECH DVR, NVR, and IP camera devices within the adcommand.cgi endpoint that interfaces with the ActionD daemon. Authenticated users can invoke the DoShellCmd operation and supply arbitrary input through the strCmd parameter, which is passed directly to the system shell without sanitization and executes with root privileges. The issue is tracked as CVE-2025-34055 with a CVSS 4.0 score of 9.4 and is associated with CWE-20 and CWE-78.
Authenticated attackers with network access can exploit the flaw to run arbitrary operating-system commands as root on affected devices. This grants full control over the device, including the ability to read or modify data, alter configurations, or use the compromised unit as a foothold for further network activity.
The EPSS score remains low and unchanged at 0.0179, indicating limited observed exploitation interest to date. Public references include older disclosures and exploit artifacts for AVTECH devices but contain no details on vendor patches or specific mitigation steps.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-19643
Vulnerability details
An OS command injection vulnerability exists in AVTECH DVR, NVR, and IP camera devices within the adcommand.cgi endpoint, which interfaces with the ActionD daemon. Authenticated users can invoke the DoShellCmd operation, passing arbitrary input via the strCmd parameter. This input…
more
is executed directly by the system shell without sanitation allowing attackers to execute commands as the root user.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Directly implements checks on information inputs to reject invalid data before processing.
Security testing and developer training directly verify and enforce proper input validation, reducing exploitability of injection and malformed-data weaknesses.
Security testing and evaluation at multiple SDLC stages directly detects missing or flawed input validation, with the required remediation process ensuring fixes are applied.
Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.
Spam protection mechanisms perform filtering and detection on inbound/outbound messages, directly compensating for missing or weak input validation of unsolicited content.