CVE-2018-25126
CriticalSummary
Shenzhen TVT Digital Technology NVMS-9000 firmware contains hardcoded API credentials and an OS command injection flaw in its configuration services. An unauthenticated remote attacker can exploit these to access endpoints and execute arbitrary commands as root.
Risk Assessment
The risk includes full compromise of the device (DVR/NVR/IPC) by a remote attacker, potentially leading to data integrity breaches, espionage, or use of the device as part of a botnet.
Recommendation
Immediately update the firmware to versions from mid-February 2018 or later, and restrict access to management interfaces to trusted networks only.
Original NVD description (English source)
Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 firmware (used by many white-labeled DVR/NVR/IPC products) contains hardcoded API credentials and an OS command injection flaw in its configuration services. The web/API interface accepts HTTP/XML requests authenticated with a fixed vendor credential string and passes user-controlled fields into shell execution contexts without proper argument sanitization. An unauthenticated remote attacker can leverage the hard-coded credential to access endpoints such as /editBlackAndWhiteList and inject shell metacharacters inside XML parameters, resulting in arbitrary command execution as root. The same vulnerable backend is also reachable in some models through a proprietary TCP service on port 4567 that accepts a magic GUID preface and base64-encoded XML, enabling the same command injection sink. Firmware releases from mid-February 2018 and later are reported to have addressed this issue. Exploitation evidence was observed by the Shadowserver F