CVE-2025-34051CWE-200CWE-918

AVTECH DVR Devices Server-Side Request Forgery

Medium · published July 1, 2025

CVSS v4.0
6.9
EPSS
1%
Percentile
47.2
In the wild
Unconfirmed
What it is

A server-side request forgery vulnerability exists in multiple firmware versions of AVTECH DVR devices that exposes the /cgi-bin/nobody/Search.cgi?action=cgi_query endpoint without authentication. An attacker can manipulate the ip, port, and queryb64str parameters to make arbitrary HTTP requests from the DVR to internal or external systems, potentially exposing sensitive data or interacting with internal services.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L
EPSS
0.00584 · 47.2th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-918 · Server-Side Request Forgery (SSRF)
Published
2025-07-01T14:44Z
EPSS history
Timeline
  • 01 JUL 14:44Z
    AVTECH DVR Devices Server-Side Request Forgery
    cvelistv5