PT-2025-26991
CVE-2025-34042
·
Published
2025-06-26
·
Updated
2026-10-01
Description by
CVSS 4.0
9.4
CriticalMetricsAV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Beward N100 IP Camera version M2.1.6.04C014
Description
An authenticated command injection issue exists in the Beward N100 IP Camera firmware. An attacker with web interface access can inject arbitrary system commands through the
ServerName and TimeZone parameters in the servetest CGI page. These parameters are unsafely incorporated into backend system calls without sufficient input validation. Successful exploitation can lead to remote code execution with root privileges. The Shadowserver Foundation observed exploitation evidence on 2024-12-02 UTC. The vulnerable component is the servetest CGI page, specifically the handling of the ServerName and TimeZone parameters.Recommendations
Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the servetest CGI page to minimize the risk of exploitation.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾