CVE-2018-25126
BaseFortify
Publication date: 2025-11-24
Last updated on: 2025-11-24
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| shenzhen_tvt_digital_technology_co_ltd | nvms-9000_firmware | 4.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-798 | The product contains hard-coded credentials, such as a password or cryptographic key. |
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 firmware, which is used by many white-labeled DVR/NVR/IPC products. It involves hardcoded API credentials and an OS command injection flaw in its configuration services. The web/API interface uses fixed vendor credentials and accepts HTTP/XML requests without properly sanitizing user input before passing it to shell execution contexts. An unauthenticated remote attacker can exploit this by using the hardcoded credentials to access certain endpoints and inject shell metacharacters in XML parameters, leading to arbitrary command execution with root privileges. Additionally, some models expose the same vulnerability through a proprietary TCP service on port 4567 that accepts specially formatted XML data. Firmware versions from mid-February 2018 and later have addressed this issue.
How can this vulnerability impact me? :
This vulnerability can have severe impacts because it allows an unauthenticated remote attacker to execute arbitrary commands as root on affected devices. This can lead to full system compromise, unauthorized access to sensitive data, disruption of device functionality, and potentially using the compromised device as a foothold for further attacks within a network.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the NVMS-9000 firmware to a version released after mid-February 2018, as these versions have addressed the issue. Additionally, restrict access to the vulnerable web/API interface and the proprietary TCP service on port 4567 to trusted networks only.