CVE-2025-34050 json
AVTECH IP Camera, DVR, and NVR Devices Cross-Site Request Forgery
published last yr. modified 4mo ago also EUVD-2025-19647
- cvss
- 5.1
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 20%
- public exploits
- 0
- none known
Summary
A cross-site request forgery (CSRF) vulnerability exists in the web interface of AVTECH IP camera, DVR, and NVR devices. An attacker can craft malicious requests that, when executed in the context of an authenticated user’s browser session, allow unauthorized changes to the device configuration without user interaction.
Is CVE-2025-34050 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- exploit-db.com https://www.exploit-db.com/exploits/40500 referenced PoC, tagged "exploit" by a source, unverified
- web.archive.org https://web.archive.org/web/20161029201749/https://github.com/ebux/AVTECH referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 5.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- AVTECH IP cameras
- AVTECH DVR devices
- AVTECH NVR devices
Classification
- Weakness
-
- CWE-352 Cross-Site Request Forgery
References
-
exploit-db.com
/exploits/40500
exploit
-
web.archive.org
/web/20161029201749/https://github.com/ebux/AVTECH
exploit
-
avtech.com
/
product
-
web.archive.org
/web/20240810225729/https://www.search-lab.hu/advisories/126-AVTech-devices-multiple-vulnerabilities
third-party-advisory, technical-description
-
vulncheck.com
/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns
third-party-advisory
Sources
- CVE List CVE-2025-34050
- NVD CVE-2025-34050
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.