EUVD-2025-18965
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Tags
Description
An OS command injection vulnerability exists in white-labeled DVRs manufactured by TVT, affecting a custom HTTP service called "Cross Web Server" that listens on TCP ports 81 and 82. The web interface fails to sanitize input in the URI path passed to the language extraction functionality. When the server processes a request to /language/[lang]/index.html, it uses the [lang] input unsafely in a tar extraction command without proper escaping. This allows an unauthenticated remote attacker to inject shell commands and achieve arbitrary command execution as root. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.
Analysis
White-labeled DVRs manufactured by TVT contain an unauthenticated OS command injection in the 'Cross Web Server' HTTP service on ports 81/82. The URI path handling for language extraction fails to sanitize input, enabling remote attackers to execute arbitrary commands on the surveillance DVR.
Technical Context
The custom 'Cross Web Server' on TCP ports 81 and 82 processes URI paths for language/locale extraction. The path component is passed to system commands without sanitization. These DVRs are white-labeled under many brand names, making the true scope of affected devices much larger than the TVT brand alone.
Affected Products
['TVT DVRs with Cross Web Server', 'White-labeled variants (multiple brands)']
Remediation
Update DVR firmware. Block ports 81/82 from the internet. Isolate DVRs on a dedicated surveillance VLAN. Use VPN for remote DVR access.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today