{"id":"CVE-2025-34053","aliases":["EUVD-2025-19645","GHSA-r5g5-cgx4-4r36"],"status":"published","title":"AVTECH IP camera, DVR, and NVR Devices Authentication Bypass via .cab Path Manipulation","description":"An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr() function is used to identify \".cab\" requests, allowing any URL containing \".cab\" to bypass authentication and access protected endpoints.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00629,"percentile":0.50475,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-290"],"published":"2025-07-01T14:45:02Z","modified":"2026-06-17T09:13:23Z","products":[{"vendor":"avtech","product":"ip camera, dvr, and nvr devices"}],"references":[{"url":"https://www.exploit-db.com/exploits/40500","tags":["exploit"]},{"url":"https://avtech.com/","tags":["product"]},{"url":"https://web.archive.org/web/20240810225729/https://www.search-lab.hu/advisories/126-AVTech-devices-multiple-vulnerabilities","tags":["third-party-advisory","technical-description"]},{"url":"https://web.archive.org/web/20161029201749/https://github.com/ebux/AVTECH","tags":["exploit"]},{"url":"https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns","tags":["third-party-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-34053"},{"url":"https://avtech.com"},{"url":"https://github.com/advisories/GHSA-r5g5-cgx4-4r36"}],"sources":{"cve":[{"id":"CVE-2025-34053","title":"AVTECH IP camera, DVR, and NVR Devices Authentication Bypass via .cab Path Manipulation","description":"An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr() function is used to identify \".cab\" requests, allowing any URL containing \".cab\" to bypass authentication and access protected endpoints.","status":"published","published":"2025-07-01T14:45:02.858Z","modified":"2026-04-07T14:09:15.581Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:32:54.534202Z"}],"euvd":[{"id":"EUVD-2025-19645","description":"An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr() function is used to identify \".cab\" requests, allowing any URL containing \".cab\" to bypass authentication and access protected endpoints.","status":"published","published":"2025-07-01T14:45:02Z","modified":"2026-04-07T14:09:15Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:25:12.908169Z"}],"ghsa":[{"id":"GHSA-r5g5-cgx4-4r36","title":"An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd...","description":"An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr() function is used to identify \".cab\" requests, allowing any URL containing \".cab\" to bypass authentication and access protected endpoints.","status":"published","published":"2025-07-01T15:31:09Z","modified":"2025-07-01T15:31:16Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T15:02:52.793128Z"}],"nvd":[{"id":"CVE-2025-34053","description":"An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr() function is used to identify \".cab\" requests, allowing any URL containing \".cab\" to bypass authentication and access protected endpoints.","status":"published","published":"2025-07-01T15:15:23.76Z","modified":"2026-06-17T09:13:23.117Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:11:15.754475Z"}]}}