CVE-2025-34065CWE-290

AVTECH IP camera, DVR, and NVR Devices Authentication Bypass via /nobody URL Path

Medium · published July 1, 2025

CVSS v4.0
6.9
EPSS
1%
Percentile
48.8
In the wild
Unconfirmed
What it is

An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr() function allows unauthenticated access to any request containing "/nobody" in the URL, bypassing login controls.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00616 · 48.8th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2025-07-01T14:47Z
EPSS history
Timeline
  • 01 JUL 14:47Z
    AVTECH IP camera, DVR, and NVR Devices Authentication Bypass via /nobody URL Path
    cvelistv5