PT-2025-47959 · Shenzhen Tvt Digital Technology Co. · Nvms-9000

Published 2025-11-24 · Updated 2025-11-25 · CVE-2024-14007

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 firmware versions prior to 1.3.4

Description The NVMS-9000 firmware contains a flaw that allows unauthorized remote access. An attacker can send a specially crafted TCP payload to the NVMS-9000 control port, bypassing authentication and executing privileged administrative commands. This allows disclosure of sensitive information, including administrator usernames and passwords, network configurations, service configurations, and device details. Specific commands used for this disclosure include queryBasicCfg, queryUserList, queryEmailCfg, queryPPPoECfg, and queryFTPCfg.

Recommendations Update to version 1.3.4 or later.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2024-14007

Affected Products

Nvms-9000

References · 9

• 🔥 https://ssd-disclosure.com/ssd-advisory-nvms9000-information-disclosure · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-14007 · Security Note
• https://twitter.com/VulmonFeeds/status/1993156115710845011 · Twitter Post
• https://twitter.com/CVEnew/status/1993057414111744158 · Twitter Post
• https://twitter.com/ET_Labs/status/1993432904823972095 · Twitter Post
• https://vulncheck.com/advisories/tvt-nvms9000-unauthenticated-admin-queries-and-information-disclosure · Note
• https://greynoise.io/blog/surge-exploitation-attempts-tvt-dvrs · Note
• https://t.me/CVEtracker/38117 · Telegram Post
• https://undercodetesting.com/eleven11-botnet-mirai-variant-targeting-nvms-9000-devices · Note