CVE-2025-57201

HighCVSS 8.8

Published: 03/12/2025(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

12.77%

96th percentile - higher than 96% of all known CVEs

Summary

An authenticated command injection vulnerability was discovered in the SMB server function of AVTECH SECURITY Corporation DGM1104 (firmware version FullImg-1015-1004-1006-1003). This flaw allows attackers to execute arbitrary system commands via crafted input.

Risk Assessment

An authenticated attacker can gain full control over the device, compromising confidentiality, integrity, and availability, and potentially pivot to other systems on the internal network.

Recommendation

Immediately update the device firmware to the latest version provided by the vendor and restrict management interface access to trusted IP addresses only.

Original NVD description (English source)

AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability in the SMB server function. This vulnerability allows attackers to execute arbitrary commands via a crafted input.