Which versions of AVTECH DGM3103SCT are affected by EUVD-2026-40265?

AVTECH DGM3103SCT surveillance devices contain a command injection vulnerability allowing authenticated administrative users to gain root-level control of affected equipment.

How to fix or mitigate EUVD-2026-40265?

Within 24 hours: Identify and inventory all AVTECH DGM3103SCT devices; restrict web management console access to explicitly approved administrators and enable multi-factor authentication where supported. Within 7 days: Isolate surveillance devices from critical infrastructure via network segmentation; disable unnecessary remote console access; configure comprehensive logging of all administrative activities. Within 30 days: Monitor JPCERT/CC JVN28979424 and vendor security advisories for patch availability; prepare replacement or remediation plan for affected devices when patches become available.

AVTECH DGM3103SCT EUVD-2026-40265

Q: What is the CVSS score of EUVD-2026-40265?

EUVD-2026-40265 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.6%.

| CVE-2026-56808 HIGH

OS Command Injection (CWE-78)

2026-06-30 jpcert

GHSA-xqc8-pr7j-cj3w

Command Injection Dgm3103Sct

8.6

CVSS 4.0 · Vendor: jpcert

Severity by source

Vendor (jpcert) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Network-reachable console (AV:N) with simple injection (AC:L) but requires an authenticated privileged console user (PR:H), yielding full root C/I/A impact on the device (S:U).

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (jpcert).

CVSS VectorVendor: jpcert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 07:33 vuln.today

CVSS changed

Jun 30, 2026 - 07:22 NVD

7.2 (HIGH) 8.6 (HIGH)

DescriptionCVE.org

DGM3103SCT provided by AVTECH Security Corporation contains an OS command injection vulnerability, which may lead to arbitrary command execution with the root privilege by a user who can log in to the web management console of the affected product.

AnalysisAI

Privileged OS command injection in the AVTECH Security Corporation DGM3103SCT surveillance device lets an authenticated user of the web management console inject operating-system commands that run with root privilege (CWE-78). Disclosed via JPCERT/CC coordination (JVN28979424), it carries CVSS 4.0 base 8.6 with no public exploit identified at time of analysis. Because the CVSS vector requires high privileges (PR:H), exploitation presumes a logged-in administrative web user, but successful abuse yields full root-level device takeover.

Technical ContextAI

The affected product is an AVTECH IP/surveillance appliance (CPE cpe:2.3:a:avtech_security_corporation:dgm3103sct), part of AVTECH's networked camera/recorder ecosystem. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command): a web management console parameter is passed into a shell or system() invocation without sanitization, so shell metacharacters (e.g. ;, |, &&, backticks) injected by the operator break out of the intended command. On embedded Linux camera/NVR firmware the web service typically runs as root, which is why injected commands execute with root privilege rather than a constrained service account.

RemediationAI

No exact fixed firmware version is present in the provided data, so consult the AVTECH/JPCERT coordinated advisory JVN28979424 (https://jvn.jp/en/jp/JVN28979424/) and the AVTECH product page (https://www.avtech.com.tw/global/en/IP%20Camera?search=DGM3103SCT) for the vendor-released patched firmware and apply it as the primary fix once published. Until a patched build is confirmed, do not expose the web management console to the internet - place the device on an isolated VLAN or management network and block external access to its HTTP/HTTPS admin port at the firewall (trade-off: legitimate remote management must then go through a VPN). Restrict console access to a minimal set of trusted administrator accounts, replace default/weak credentials, and monitor console logins, since the flaw is reachable only by authenticated users; auditing who holds console accounts is the most effective compensating control given the PR:H requirement.