CVE-2025-34054

Name of the Vulnerable Software and Affected Versions AVTECH DVR (affected versions not specified)

Description An unauthenticated command injection issue exists in AVTECH DVR devices. The vulnerability occurs because the wget utility is used without proper input sanitization in the 'Search.cgi?action=cgi query' endpoint. This allows remote attackers to inject shell commands through the username or queryb64str parameters, resulting in the execution of arbitrary code with root privileges. Real-world exploitation of this issue was observed by the Shadowserver Foundation on 2025-03-07 UTC.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.