PT-2025-15329 · Vivotek · Vivotek Nvr Nd8422P+2

Syrtain · Published 2025-04-08 · Updated 2025-04-08 · CVE-2025-3403

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Low

Base vector

AV:N/AC:L/Au:M/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Vivotek NVR ND8422P, NVR ND9525P and NVR ND9541P versions 2.4.0.204/3.3.0.104/4.2.0.101

Description: A vulnerability was found in the HTML Form Handler component of Vivotek NVR devices. The manipulation leads to the inclusion of sensitive information in the source code. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

CWE-540

Related Identifiers

CVE-2025-3403

Affected Products

Vivotek Nvr Nd8422P

Vivotek Nvr Nd9525P

Vivotek Nvr Nd9541P

References · 10

• 🔥 https://github.com/lfparizzi/CVE-VIVOTEK-ID/blob/main/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-3403 · Security Note
• https://t.me/cvedetector/22391 · Telegram Post
• https://t.me/cvetracker/21074 · Telegram Post
• https://vuldb.com/?id.303648 · Note
• https://twitter.com/CVEnew/status/1909453438569558022 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1909607287922078112 · Twitter Post
• https://vuldb.com/?ctiid.303648 · Note
• https://vuldb.com/?submit.543589 · Note
• https://t.me/cvenotify/118148 · Telegram Post