CVE-2025-5113

Authenticated Remote Command Injection in Diviotec NBR IP Cameras

State: Published
Severity: 8.6 High
Published: Jun 2, 2025
Updated: Jun 2, 2025
Reserved: May 23, 2025

Description

The Diviotec professional series exposes a web interface. One endpoint is vulnerable to arbitrary command injection and hardcoded passwords are used.

Scores

CVSS	Score	Vector	Source
4.0	8.6 High	CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	ONEKEY

Weaknesses

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

Affected Products

Product	Versions
nbr222pDiviotec	2.0170.3030 and earlierAffected
nbr222pvDiviotec	2.0170.3030 and earlierAffected
nbr224pDiviotec	2.0170.3030 and earlierAffected
nbr225pDiviotec	2.0170.3030 and earlierAffected
nbr226pDiviotec	2.0170.3030 and earlierAffected
nbf232pDiviotec	2.0170.3030 and earlierAffected
nbf233pDiviotec	2.0170.3030 and earlierAffected
ndr252pDiviotec	2.0170.3030 and earlierAffected
ndr255pDiviotec	2.0170.3030 and earlierAffected

References

https://www.onekey.com/resource/security-advisory-remote-code-execution-on-diviotec-ip-camera-cve-2025-5113third-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.