CVE-2025-34065

AVTECH IP camera, DVR, and NVR Devices Authentication Bypass via /nobody URL Path

State: Published
Severity: 6.9 Medium
Published: Jul 1, 2025
Updated: Apr 7, 2026
Reserved: Apr 15, 2025

Description

An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr() function allows unauthenticated access to any request containing "/nobody" in the URL, bypassing login controls.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N	VulnCheck

Weaknesses

CWE-290 Authentication Bypass by Spoofing

Affected Products

Product	Versions
IP camera, DVR, and NVR DevicesAVTECH	1000-1000-1000-1000Affected 1000C-1000C-1000C-1000CAffected 1001-1000-1000-1000Affected 1001-1001-1000-1000Affected 1002-1000-1000-1000Affected 1002-1002-1000-1002Affected 1002D-1000D-1000D-1000DAffected 1003-1000-1000-1001Affected 1003-1001-1001-1000Affected 1003-1002-1001-1000Affected 1004-1000-1000-1000Affected 1004-1001-1001-1001Affected 1004-1002-1000-1001Affected 1004-1003-1001-1002Affected 1004-1003-1002-1001Affected 1004A-1001A-1002A-1000AAffected 1005-1002-1001-1002Affected 1005-1003-1001-1002Affected 1005-1004-1002-1001Affected 1005A-1001A-1002A-1001AAffected 1005D-1001D-1002D-1001DAffected 1006-1002-1001-1002Affected 1006-1003-1001-1001Affected 1006-1004-1003-1001Affected 1007-1001-1003-1001Affected and 27 more versions

Product

Versions

IP camera, DVR, and NVR DevicesAVTECH

1000-1000-1000-1000Affected
1000C-1000C-1000C-1000CAffected
1001-1000-1000-1000Affected
1001-1001-1000-1000Affected
1002-1000-1000-1000Affected
1002-1002-1000-1002Affected
1002D-1000D-1000D-1000DAffected
1003-1000-1000-1001Affected
1003-1001-1001-1000Affected
1003-1002-1001-1000Affected
1004-1000-1000-1000Affected
1004-1001-1001-1001Affected
1004-1002-1000-1001Affected
1004-1003-1001-1002Affected
1004-1003-1002-1001Affected
1004A-1001A-1002A-1000AAffected
1005-1002-1001-1002Affected
1005-1003-1001-1002Affected
1005-1004-1002-1001Affected
1005A-1001A-1002A-1001AAffected
1005D-1001D-1002D-1001DAffected
1006-1002-1001-1002Affected
1006-1003-1001-1001Affected
1006-1004-1003-1001Affected
1007-1001-1003-1001Affected
and 27 more versions

References

https://www.exploit-db.com/exploits/40500exploit
https://avtech.com/product
https://web.archive.org/web/20240810225729/https://www.search-lab.hu/advisories/126-AVTech-devices-multiple-vulnerabilitiesthird-party-advisorytechnical-description
https://web.archive.org/web/20161029201749/https://github.com/ebux/AVTECHexploit
https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulnsthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.