What is the CVSS score of CVE-2025-34055?

CVE-2025-34055 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. EPSS exploitation probability: 0.4%.

Which versions of AVTECH DVR are affected by CVE-2025-34055?

CVE-2025-34055 presents critical security risk, a input validation vulnerability rated CVSS 9.4.

Is there a public PoC exploit available for CVE-2025-34055?

Yes, a public proof-of-concept exploit is available for CVE-2025-34055. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2025-34055?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Monitor vendor channels for patch availability.

AVTECH DVR CVE-2025-34055

EUVD-2025-19643 CRITICAL

Improper Input Validation (CWE-20)

2025-07-01 disclosure@vulncheck.com

Command Injection

9.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 01:42 euvd

EUVD-2025-19643

Analysis Generated

Mar 16, 2026 - 01:42 vuln.today

PoC Detected

Jul 03, 2025 - 15:14 vuln.today

Public exploit code

CVE Published

Jul 01, 2025 - 15:15 nvd

CRITICAL 9.4

DescriptionCVE.org

An OS command injection vulnerability exists in AVTECH DVR, NVR, and IP camera devices within the adcommand.cgi endpoint, which interfaces with the ActionD daemon. Authenticated users can invoke the DoShellCmd operation, passing arbitrary input via the strCmd parameter. This input is executed directly by the system shell without sanitation allowing attackers to execute commands as the root user.

Analysis

Technical ContextAI

Command injection allows an attacker to execute arbitrary OS commands on the host system through a vulnerable application that passes user input to system shells. This vulnerability is classified as Improper Input Validation (CWE-20).

RemediationAI

Avoid passing user input to system commands. Use language-specific APIs instead of shell commands. If unavoidable, use strict input validation and escaping.

CVE-2025-34055 vulnerability details – vuln.today

Back