What is the CVSS score of EUVD-2025-19642?

EUVD-2025-19642 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. EPSS exploitation probability: 0.4%.

Which versions of AVTECH IP are affected by EUVD-2025-19642?

CVE-2025-34056 presents critical security risk, a input validation vulnerability rated CVSS 9.4.

Is there a public PoC exploit available for EUVD-2025-19642?

Yes, a public proof-of-concept exploit is available for EUVD-2025-19642. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate EUVD-2025-19642?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Monitor vendor channels for patch availability.

AVTECH IP EUVD-2025-19642

| CVE-2025-34056 CRITICAL

Improper Input Validation (CWE-20)

2025-07-01 disclosure@vulncheck.com

Command Injection

9.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 01:42 euvd

EUVD-2025-19642

Analysis Generated

Mar 16, 2026 - 01:42 vuln.today

PoC Detected

Jul 03, 2025 - 15:14 vuln.today

Public exploit code

CVE Published

Jul 01, 2025 - 15:15 nvd

CRITICAL 9.4

DescriptionCVE.org

An OS command injection vulnerability exists in AVTECH IP camera, DVR, and NVR devices via the PwdGrp.cgi endpoint, which handles user and group management operations. Authenticated users can supply input through the pwd or grp parameters, which are directly embedded into system commands without proper sanitation. This allows for the execution of arbitrary shell commands with root privileges.

Analysis

Technical ContextAI

Command injection allows an attacker to execute arbitrary OS commands on the host system through a vulnerable application that passes user input to system shells. This vulnerability is classified as Improper Input Validation (CWE-20).

RemediationAI

Avoid passing user input to system commands. Use language-specific APIs instead of shell commands. If unavoidable, use strict input validation and escaping.

EUVD-2025-19642 vulnerability details – vuln.today

Back