CVE-2025-34053
AVTECH IP camera, DVR, and NVR Devices Authentication Bypass via .cab Path Manipulation
MEDIUM 6.9EPSS 0.6%
An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr() function is used to identify ".cab" requests, allowing any URL containing ".cab" to bypass authentication and access protected endpoints.
- Affected
- AVTECH · IP camera, DVR, and NVR devices
- CVSS v4.0 VULNCHECK
- 6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS
- 0.63% chance of exploitation in the next 30 days, 49th percentile
- Published
- 2025-07-01
- Updated
- 2026-04-07
Proof-of-concept exploits (2)
- https://web.archive.org/web/20161029201749/https://github.com/ebux/AVTECH
- https://www.exploit-db.com/exploits/40500