CVEvulnerability
CVE-2025-34053
6.9 MEDIUM
Official page ↗
- Status
- Deferred
- Published
- 2025-07-01
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 6.9 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Weaknesses
- CWE-290
Description
An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr() function is used to identify ".cab" requests, allowing any URL containing ".cab" to bypass authentication and access protected endpoints.
Related
Weakness · CWE (1)
- CWE-290 Authentication Bypass by Spoofing weakness
References
- https://avtech.com/ avtech.com
- https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns vulncheck.com
- https://web.archive.org/web/20161029201749/https://github.com/ebux/AVTECH web.archive.org
- https://web.archive.org/web/20240810225729/https://www.search-lab.hu/advisories/126-AVTech-devices-multiple-vulnerabilities web.archive.org
- https://www.exploit-db.com/exploits/40500 www.exploit-db.com