PT-2025-27537 · Avtech · Avtech Dvr+2

Gergely Eberhardt · Published 2025-07-01 · Updated 2025-07-01 · CVE-2025-34053

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: AVTECH IP camera, DVR, and NVR devices (affected versions not specified)

Description: An authentication bypass issue exists in the streamd web server of AVTECH devices. The strstr() function is used to identify ".cab" requests, allowing any URL containing ".cab" to bypass authentication and access protected endpoints.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2025-34053

Affected Products

Avtech Dvr

Avtech Ip Cameras

Avtech Nvr

References · 8

• 🔥 https://web.archive.org/web/20161029201749/https://github.com/ebux/AVTECH · Exploit
• 🔥 https://exploit-db.com/exploits/40500 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-34053 · Security Note
• https://twitter.com/VulmonFeeds/status/1940138087981461660 · Twitter Post
• https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns · Note
• https://avtech.com · Note
• https://twitter.com/CVEnew/status/1940067223705366891 · Twitter Post
• https://web.archive.org/web/20240810225729/https://search-lab.hu/advisories/126-AVTech-devices-multiple-vulnerabilities · Note