CVE-2025-34053

Impact

An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr() function is used to identify ".cab" requests, allowing any URL containing ".cab" to bypass authentication and access protected endpoints.

Affected packages

This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.

Weakness classification

References

• NVD record
• CVE.org record
• https://avtech.com/
• https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns
• https://web.archive.org/web/20161029201749/https://github.com/ebux/AVTECH
• https://web.archive.org/web/20240810225729/https://www.search-lab.hu/advisories/126-AVTech-devices-multiple-vulnerabilities
• https://www.exploit-db.com/exploits/40500