CVE-2025-34053CWE-290

AVTECH IP camera, DVR, and NVR Devices Authentication Bypass via .cab Path Manipulation

Medium · published July 1, 2025

CVSS v4.0
6.9
EPSS
1%
Percentile
49.5
In the wild
Unconfirmed
What it is

An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr() function is used to identify ".cab" requests, allowing any URL containing ".cab" to bypass authentication and access protected endpoints.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00629 · 49.5th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2025-07-01T14:45Z
EPSS history
Timeline
  • 01 JUL 14:45Z
    AVTECH IP camera, DVR, and NVR Devices Authentication Bypass via .cab Path Manipulation
    cvelistv5