CVE-2025-34050
AVTECH IP Camera, DVR, and NVR Devices Cross-Site Request Forgery
- State
- Published
- Severity
- 5.1 Medium
- Published
- Jul 1, 2025
- Updated
- Apr 7, 2026
- Reserved
- Apr 15, 2025
Description
A cross-site request forgery (CSRF) vulnerability exists in the web interface of AVTECH IP camera, DVR, and NVR devices. An attacker can craft malicious requests that, when executed in the context of an authenticated user’s browser session, allow unauthorized changes to the device configuration without user interaction.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
Weaknesses
- CWE-352 Cross-Site Request Forgery (CSRF)
Affected Products
| Product | Versions |
|---|---|
IP camerasAVTECH |
|
DVR devicesAVTECH |
|
NVR devicesAVTECH |
|
References
- https://www.exploit-db.com/exploits/40500exploit
- https://avtech.com/product
- https://web.archive.org/web/20240810225729/https://www.search-lab.hu/advisories/126-AVTech-devices-multiple-vulnerabilitiesthird-party-advisorytechnical-description
- https://web.archive.org/web/20161029201749/https://github.com/ebux/AVTECHexploit
- https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulnsthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.