What is the CVSS score of EUVD-2025-19643?

EUVD-2025-19643 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. EPSS exploitation probability: 0.4%.

Which versions of AVTECH DVR are affected by EUVD-2025-19643?

CVE-2025-34055 presents critical security risk, a input validation vulnerability rated CVSS 9.4.

Is there a public PoC exploit available for EUVD-2025-19643?

Yes, a public proof-of-concept exploit is available for EUVD-2025-19643. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate EUVD-2025-19643?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Monitor vendor channels for patch availability.

AVTECH DVR EUVD-2025-19643

| CVE-2025-34055 CRITICAL

Improper Input Validation (CWE-20)

2025-07-01 disclosure@vulncheck.com

Command Injection

9.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 01:42 euvd

EUVD-2025-19643

Analysis Generated

Mar 16, 2026 - 01:42 vuln.today

PoC Detected

Jul 03, 2025 - 15:14 vuln.today

Public exploit code

CVE Published

Jul 01, 2025 - 15:15 nvd

CRITICAL 9.4

DescriptionCVE.org

An OS command injection vulnerability exists in AVTECH DVR, NVR, and IP camera devices within the adcommand.cgi endpoint, which interfaces with the ActionD daemon. Authenticated users can invoke the DoShellCmd operation, passing arbitrary input via the strCmd parameter. This input is executed directly by the system shell without sanitation allowing attackers to execute commands as the root user.

Analysis

Technical ContextAI

Command injection allows an attacker to execute arbitrary OS commands on the host system through a vulnerable application that passes user input to system shells. This vulnerability is classified as Improper Input Validation (CWE-20).

RemediationAI

Avoid passing user input to system commands. Use language-specific APIs instead of shell commands. If unavoidable, use strict input validation and escaping.

EUVD-2025-19643 vulnerability details – vuln.today

Back