CVE-2024-14007
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-24

Last updated on: 2025-11-24

Assigner: VulnCheck

Description
Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 firmware (used by many white-labeled DVR/NVR/IPC products) versions prior to 1.3.4 contain an authentication bypass in the NVMS-9000 control protocol. By sending a single crafted TCP payload to an exposed NVMS-9000 control port, an unauthenticated remote attacker can invoke privileged administrative query commands without valid credentials. Successful exploitation discloses sensitive information including administrator usernames and passwords in cleartext, network and service configuration, and other device details via commands such as queryBasicCfg, queryUserList, queryEmailCfg, queryPPPoECfg, and queryFTPCfg.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-24
Last Modified
2025-11-24
Generated
2026-06-16
AI Q&A
2025-11-24
EPSS Evaluated
2026-06-14
NVD
CVE-2024-14007
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
shenzhen_tvt_digital_technology_co.,_ltd. nvms-9000 *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass in the NVMS-9000 control protocol used by Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 firmware versions prior to 1.3.4. An unauthenticated remote attacker can send a specially crafted TCP payload to an exposed NVMS-9000 control port and execute privileged administrative query commands without needing valid credentials. This allows the attacker to access sensitive information such as administrator usernames and passwords in cleartext, as well as network and service configurations and other device details.

Impact Analysis

Exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information including administrator usernames and passwords, network and service configurations, and other device details. This could allow attackers to gain further unauthorized access, compromise device security, and potentially control or disrupt the affected DVR/NVR/IPC products.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2024-14007. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart