CVE-2025-7723

Deeper analysis

A command injection vulnerability tracked as CVE-2025-7723 affects TP-Link VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2 network video recorders. The flaw, assigned CWE-78, permits an authenticated attacker to inject operating system commands and is present in VIGI NVR1104H-4P V1 firmware prior to 1.1.5 Build 250518 and in VIGI NVR2016H-16MP V2 firmware prior to 1.3.1 Build 250407. The issue carries a CVSS 4.0 score of 8.5 reflecting high impact on confidentiality, integrity, and availability when exploited over an adjacent network with high privileges.

An attacker who has already obtained valid administrative credentials on an affected device can supply crafted input that results in arbitrary command execution. Successful exploitation grants the ability to read, modify, or delete data and to alter device behavior without further user interaction.

Firmware updates that resolve the vulnerability are available from the vendor at the listed TP-Link support pages for each model, along with an accompanying FAQ that directs administrators to apply the corrected builds.

EPSS for the CVE rose from a low baseline to a recorded peak of 0.0139, indicating emerging exploitation interest after disclosure that warrants renewed attention despite the current value of 0.0044.