CVE-2024-14007
TVT NVMS-9000 < 1.3.4 Unauthenticated Administrative Queries & Information Disclosure
- State
- Published
- Severity
- 8.7 High
- Published
- Nov 24, 2025
- Updated
- Nov 25, 2025
- Reserved
- Oct 22, 2025
Description
Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 firmware (used by many white-labeled DVR/NVR/IPC products) versions prior to 1.3.4 contain an authentication bypass in the NVMS-9000 control protocol. By sending a single crafted TCP payload to an exposed NVMS-9000 control port, an unauthenticated remote attacker can invoke privileged administrative query commands without valid credentials. Successful exploitation discloses sensitive information including administrator usernames and passwords in cleartext, network and service configuration, and other device details via commands such as queryBasicCfg, queryUserList, queryEmailCfg, queryPPPoECfg, and queryFTPCfg.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
Weaknesses
- CWE-306 Missing Authentication for Critical Function
Affected Products
| Product | Versions |
|---|---|
NVMS-9000Shenzhen TVT Digital Technology Co., Ltd. |
|
References
- https://ssd-disclosure.com/ssd-advisory-nvms9000-information-disclosure/technical-descriptionexploit
- https://www.greynoise.io/blog/surge-exploitation-attempts-tvt-dvrsrelated
- https://undercodetesting.com/eleven11-botnet-mirai-variant-targeting-nvms-9000-devices/related
- https://www.vulncheck.com/advisories/tvt-nvms9000-unauthenticated-admin-queries-and-information-disclosurethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.