CVE-2025-34051mediumobserved exploitationCWE-200CWE-918

CVE-2025-34051: medium-severity vulnerability in AVTECH DVR devices

AVTECH DVR Devices Server-Side Request Forgery

Published · Updated

Follow this CVE+ Monitor DVR devices

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

35Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck.

ssvc Attendcvss 6.9epss 0.6%
from disclosure to weapon
Published on NVDJul 1
VulnCheckJul 24
A server-side request forgery vulnerability exists in multiple firmware versions of AVTECH DVR devices that exposes the /cgi-bin/nobody/Search.cgi?action=cgi_query endpoint without authentication. An attacker can manipulate the ip, port, and queryb64str parameters to make arbitrary HTTP requests from the DVR to internal or external systems, potentially exposing sensitive data or interacting with internal services.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L
Affected products
AVTECH · DVR devices
Related CVEs — AVTECH DVR devices

In the same product, most dangerous first.

CVE-2025-34066HIGHAVTECH IP camera, DVR, and NVR Devices Unauthenticated Information DisclosureEPSS 0.3%CVE-2025-34050MEDIUMAVTECH IP Camera, DVR, and NVR Devices Cross-Site Request ForgeryEPSS 0.3%