{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2025-34056",
        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "state": "PUBLISHED",
        "assignerShortName": "VulnCheck",
        "dateReserved": "2025-04-15T19:15:22.549Z",
        "datePublished": "2025-07-01T14:46:52.800Z",
        "dateUpdated": "2026-04-07T14:09:17.710Z"
    },
    "containers": {
        "cna": {
            "affected": [
                {
                    "defaultStatus": "unaffected",
                    "modules": [
                        "PwdGrp.cgi user/group configuration handler",
                        "pwd parameter",
                        "grp parameter"
                    ],
                    "product": "IP camera, DVR, and NVR Devices",
                    "vendor": "AVTECH",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0"
                        }
                    ]
                }
            ],
            "credits": [
                {
                    "lang": "en",
                    "type": "finder",
                    "value": "Gergely Eberhardt (SEARCH-LAB.hu)"
                }
            ],
            "descriptions": [
                {
                    "lang": "en",
                    "supportingMedia": [
                        {
                            "base64": false,
                            "type": "text/html",
                            "value": "An OS command injection vulnerability exists in AVTECH IP camera, DVR, and NVR devices via the <code>PwdGrp.cgi</code> endpoint, which handles user and group management operations. Authenticated users can supply input through the <code>pwd</code> or <code>grp</code> parameters, which are directly embedded into system commands without proper sanitation. This allows for the execution of arbitrary shell commands with root privileges."
                        }
                    ],
                    "value": "An OS command injection vulnerability exists in AVTECH IP camera, DVR, and NVR devices via the PwdGrp.cgi endpoint, which handles user and group management operations. Authenticated users can supply input through the pwd or grp parameters, which are directly embedded into system commands without proper sanitation. This allows for the execution of arbitrary shell commands with root privileges."
                }
            ],
            "impacts": [
                {
                    "capecId": "CAPEC-88",
                    "descriptions": [
                        {
                            "lang": "en",
                            "value": "CAPEC-88 OS Command Injection"
                        }
                    ]
                },
                {
                    "capecId": "CAPEC-137",
                    "descriptions": [
                        {
                            "lang": "en",
                            "value": "CAPEC-137 Parameter Injection"
                        }
                    ]
                }
            ],
            "metrics": [
                {
                    "cvssV4_0": {
                        "Automatable": "NOT_DEFINED",
                        "Recovery": "NOT_DEFINED",
                        "Safety": "NOT_DEFINED",
                        "attackComplexity": "LOW",
                        "attackRequirements": "NONE",
                        "attackVector": "NETWORK",
                        "baseScore": 9.4,
                        "baseSeverity": "CRITICAL",
                        "privilegesRequired": "LOW",
                        "providerUrgency": "NOT_DEFINED",
                        "subAvailabilityImpact": "HIGH",
                        "subConfidentialityImpact": "HIGH",
                        "subIntegrityImpact": "HIGH",
                        "userInteraction": "NONE",
                        "valueDensity": "NOT_DEFINED",
                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
                        "version": "4.0",
                        "vulnAvailabilityImpact": "HIGH",
                        "vulnConfidentialityImpact": "HIGH",
                        "vulnIntegrityImpact": "HIGH",
                        "vulnerabilityResponseEffort": "NOT_DEFINED"
                    },
                    "format": "CVSS",
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "GENERAL"
                        }
                    ]
                }
            ],
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "cweId": "CWE-78",
                            "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
                            "lang": "en",
                            "type": "CWE"
                        }
                    ]
                },
                {
                    "descriptions": [
                        {
                            "cweId": "CWE-20",
                            "description": "CWE-20 Improper Input Validation",
                            "lang": "en",
                            "type": "CWE"
                        }
                    ]
                }
            ],
            "providerMetadata": {
                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
                "shortName": "VulnCheck",
                "dateUpdated": "2026-04-07T14:09:17.710Z"
            },
            "references": [
                {
                    "tags": [
                        "exploit"
                    ],
                    "url": "https://www.exploit-db.com/exploits/40500"
                },
                {
                    "tags": [
                        "product"
                    ],
                    "url": "https://avtech.com/"
                },
                {
                    "tags": [
                        "third-party-advisory",
                        "technical-description"
                    ],
                    "url": "https://web.archive.org/web/20240810225729/https://www.search-lab.hu/advisories/126-AVTech-devices-multiple-vulnerabilities"
                },
                {
                    "tags": [
                        "exploit"
                    ],
                    "url": "https://web.archive.org/web/20161029201749/https://github.com/ebux/AVTECH"
                },
                {
                    "tags": [
                        "third-party-advisory"
                    ],
                    "url": "https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns"
                }
            ],
            "source": {
                "discovery": "UNKNOWN"
            },
            "title": "AVTECH IP camera, DVR, and NVR Devices Authenticated Root Command Execution",
            "x_generator": {
                "engine": "Vulnogram 0.2.0"
            },
            "datePublic": "2016-10-11T00:00:00.000Z"
        },
        "adp": [
            {
                "metrics": [
                    {
                        "other": {
                            "type": "ssvc",
                            "content": {
                                "timestamp": "2025-07-01T18:34:24.733333Z",
                                "id": "CVE-2025-34056",
                                "options": [
                                    {
                                        "Exploitation": "poc"
                                    },
                                    {
                                        "Automatable": "yes"
                                    },
                                    {
                                        "Technical Impact": "total"
                                    }
                                ],
                                "role": "CISA Coordinator",
                                "version": "2.0.3"
                            }
                        }
                    }
                ],
                "title": "CISA ADP Vulnrichment",
                "providerMetadata": {
                    "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
                    "shortName": "CISA-ADP",
                    "dateUpdated": "2025-07-01T18:34:41.482Z"
                }
            }
        ]
    }
}