EUVD-2025-18965Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 9.8, EPSS 10.9%, PoC available. DVRs are prime botnet targets and the white-labeling means many more brands are affected than apparent. Compromised DVRs provide access to surveillance footage and can be used as network pivot points. |
| Exploit ScenarioDerived | An attacker discovers an internet-exposed DVR on port 81 and sends a crafted URI with injected commands. The DVR executes the commands, enrolling in a botnet. The attacker also accesses recorded surveillance footage and live camera feeds. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 15, 2026
White-labeled DVRs manufactured by TVT contain an unauthenticated OS command injection in the 'Cross Web Server' HTTP service on ports 81/82. The URI path handling for language extraction fails to sanitize input, enabling remote attackers to execute arbitrary commands on the surveillance DVR.
Earlier versions of this analysis (1)
Unauthenticated command injection in TVT DVR Cross Web Server enables remote takeover of surveillance recording systems.
RemediationAI
Update DVR firmware. Block ports 81/82 from the internet. Isolate DVRs on a dedicated surveillance VLAN. Use VPN for remote DVR access.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The custom 'Cross Web Server' on TCP ports 81 and 82 processes URI paths for language/locale extraction. The path component is passed to system commands without sanitization. These DVRs are white-labeled under many brand names, making the true scope of affected devices much larger than the TVT brand alone.
Know when Td 2004ts Cl C Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
An OS command injection vulnerability exists in white-labeled DVRs manufactured by TVT, affecting a custom HTTP service called "Cross Web Server" that listens on TCP ports 81 and 82. The web interface fails to sanitize input in the URI path passed to the language extraction functionality. When the server processes a request to /language/[lang]/index.html, it uses the [lang] input unsafely in a tar extraction command without proper escaping. This allows an unauthenticated remote attacker to inject shell commands and achieve arbitrary command execution as root. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.
Executive ViewAI
A critical unauthenticated remote code execution vulnerability affects white-labeled DVR systems from TVT, allowing attackers to gain root-level control without authentication. Organizations operating these devices face immediate risk of complete system compromise, data theft, and potential network lateral movement if exposed to internet or untrusted networks.
Implement network access controls restricting TCP ports 81/82 to trusted management networks only; deploy WAF rules blocking URI patterns containing shell metacharacters (|, &, ;, $, `, (, ), <, >, newlines) in /language/ paths; disable the HTTP service entirely if not operationally required; segment DVRs into isolated VLANs with no access to critical systems; monitor for exploitation attempts via IDS/IPS signatures detecting command injection in HTTP requests; require VPN for any remote DVR access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Exploit-DB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
GitHub PoC