PT-2025-37300 · Digiever · Digiever Nvr

An-Wei Kung + 5 · Published 2025-09-11 · Updated 2025-09-17 · CVE-2025-10265

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Digiever NVR (affected versions not specified)

Description Certain models of NVR developed by Digiever have an OS Command Injection vulnerability. This allows remote attackers to inject arbitrary OS commands and execute them on the device. Some reports indicate the vulnerability may be exploitable by unauthenticated attackers, while others state it requires authentication.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-15906

CVE-2025-10265

Affected Products

Digiever Nvr

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2025-10265 · Security Note
• https://bdu.fstec.ru/vul/2025-15906 · Security Note
• https://twitter.com/cracbot/status/1968268759585739124 · Twitter Post
• https://t.me/cveNotify/135220 · Telegram Post
• https://twitter.com/CveFindCom/status/1966451507223490646 · Twitter Post
• https://t.me/cveNotify/135430 · Telegram Post
• https://twitter.com/CVEnew/status/1966454317952446744 · Twitter Post
• https://twitter.com/offseq/status/1966743836002013391 · Twitter Post
• https://t.me/CVEtracker/32362 · Telegram Post
• https://twcert.org.tw/tw/cp-132-10375-19f1e-1.html · Note
• https://t.me/pentestingnews/68117 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1966482918517162009 · Twitter Post
• https://twitter.com/zoomeye_team/status/1967530444024689010 · Twitter Post
• https://twcert.org.tw/en/cp-139-10376-a057c-2.html · Note
• https://twitter.com/CrowdCyber_Com/status/1967431638830252463 · Twitter Post