© 2026 vulntracker.io

CVE-2025-34051

AVTECH DVR Devices Server-Side Request Forgery

MEDIUM

6.9

CVSS Score

Published: July 1, 2025 at 02:44 PM UTC

Updated: June 17, 2026 at 09:13 AM UTC

1 product affected across 1 vendorDVR

Using DVR devices by AVTECH?

Get instant alerts when new vulnerabilities affect DVR devices - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.9

Exploit prediction

EPSS 0.6%

SSVC

PoC

Description

A server-side request forgery vulnerability exists in multiple firmware versions of AVTECH DVR devices that exposes the /cgi-bin/nobody/Search.cgi?action=cgi_query endpoint without authentication. An attacker can manipulate the ip, port, and queryb64str parameters to make arbitrary HTTP requests from the DVR to internal or external systems, potentially exposing sensitive data or interacting with internal services.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

60%

1001-1000-1000-1000 1001-1000-1001-1001 1002-1000-1002-1001 1002-1001-1001-1001 1004-1002-1001-1000 1004-1002-1003-1000-FFFF 1004V-1002V-1003V-1001V 1004Y-1002Y-1001EJ-1000Y 1004Y-1002Y-1001Y-1000Y 1005-1002-1002-1000 1005-1002-1004-1001 1006-1001-1003-1004 1006-1002-1003-1000 1006Y-1002Y-1003Y-1000Y 1007-1002-1004-1000 1007-1003-1003-1002 1007-1003-1005-1001 1007E-1003E-1005EJ-1001E 1007V-1003V-1005V-1001V 1007Y-1002Y-1004Y-1000Y 1008-1002-1005-1000 1008-1004-1003-1002 1009-1003-1005-1006 1009-1003-1006-1001 1009-1007-1007-1000-FFFF 1009Y-1003Y-1006Y-1001Y 1010-1004-1007-1001 1010-1005-1005-1002 1011-1004-1005-1006 1011-1005-1007-1001 1011-1005-1007EJ-1001 1011-1005-1008-1002 1012-1004-1005-1006 1012-1005-1007-1002 1012-1006-1007-1001 1012-1008-1009-1000-FFFF 1014-1005-1009-1002 1014-1007-1009-1001 1014-1010-1010-1000-FFFF 1014Y-1007Y-1009Y-1001Y 1015-1006-1010-1003 1015-1007-1007-1007 1015-1007-1010-1001 1015-1010-1011-1000-FFFF 1015Y-1007Y-1010Y-1001Y 1016-1007-1005-1001 1016-1007-1011-1001 1016-1007-1011-1003 1016-1008-1007-1007 1016Y-1007Y-1011Y-1001Y 1017-1008-1012-1002 1017-1009-1008-1008 1017-1011-1013-1001-FFFF 1017Y-1008Y-1012Y-1002Y 1017f-1011f-1013f-1001f-FFFF 1018-1008-1012-1004 1019-1009-1013-1003 1019-1010-1009-1009 1019c-1012c-1014c-1001c-FFFF 1021-1011-1010-1009 1022-1012-1011-1009 1022-1014-1016-1002-FFFF 1022Y-1014Y-1016Y-1002Y-FFFF 1023-1013-1011-1009 1023-1014-1017-1002-FFFF 1025-1014-1013-1009 1026-1014-1014-1009 1027-1014-1015-1009 171P-V171P-V171P-V171P 189-V189-V189-V189 S968-S968-S968-S968

Vendor states this is fixed in 1002-1001-1000-1000 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (5)

Product

Source: [email protected]

https://avtech.com/

Third Party Advisory

Source: [email protected]

https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns

Exploit

Source: [email protected]

https://web.archive.org/web/20161029201749/https://github.com/ebux/AVTECH

Third Party AdvisoryTechnical Description

Source: [email protected]

https://web.archive.org/web/20240810225729/https://www.search-lab.hu/advisories/126-AVTech-devices-multiple-vulnerabilities

Exploit

Source: [email protected]

https://www.exploit-db.com/exploits/40500

SSVC — Action Prioritization

SSVCPoCAutomatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

6.9MEDIUMVulnCheck

Vector?

Quick Info

StatusDEFERRED

CWE

CWE-200CWE-918

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card