CVE-2025-57199
HighCVSS 8.8Exploitation Probability (EPSS)
High risk84th percentile - higher than 84% of all known CVEs
Summary
An authenticated command injection vulnerability was discovered in the NetFailDetectD binary of AVTECH SECURITY Corporation DGM1104 (FullImg-1015-1004-1006-1003). This vulnerability allows attackers to execute arbitrary system commands via crafted input.
Risk Assessment
The risk for the organization includes full compromise of the DGM1104 device by an authenticated attacker, potentially leading to data integrity and confidentiality breaches and further network attacks.
Recommendation
It is recommended to immediately apply security patches provided by the vendor and restrict device access to trusted users only.
Other vulnerabilities in AVTECH DGM1104
See all- CVE-2025-57201High
An authenticated command injection vulnerability was discovered in the SMB server function of AVTECH SECURITY Corporation DGM1104 (firmware version FullImg-1015-1004-1006-1003). This flaw allows attackers to execute arbitrary system commands via crafted input.
- CVE-2025-57202Medium
A stored cross-site scripting (XSS) vulnerability in the PwdGrp.cgi endpoint of AVTECH DGM1104 allows attackers to inject malicious JavaScript or HTML into the username field. Successful exploitation enables arbitrary script execution in the victim's browser context.
- CVE-2025-57198High
An authenticated command injection vulnerability was discovered in the Machine.cgi endpoint of AVTECH DGM1104 running FullImg-1015-1004-1006-1003. This flaw allows attackers to execute arbitrary commands via crafted input.
- CVE-2025-57200Medium
An authenticated command injection vulnerability was discovered in the test_mail function of AVTECH SECURITY DGM1104 (firmware version FullImg-1015-1004-1006-1003). This flaw allows an attacker to execute arbitrary system commands via crafted input.
Original NVD description (English source)
AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability in the NetFailDetectD binary. This vulnerability allows attackers to execute arbitrary commands via a crafted input.