Executive Summary

CVE-2026-34005 is an OS command injection vulnerability found in certain Xiongmai DVR/NVR devices running firmware version 4.03.R11. The issue occurs in the hostname configuration handling of the Sofia binary, which is accessed via the authenticated DVRIP protocol on TCP port 34567.

Specifically, the vulnerability arises because the device uses the system() function to execute a shell command that includes the hostname value without properly sanitizing or escaping shell metacharacters. This allows an authenticated attacker to inject arbitrary OS commands by crafting malicious hostname input.

The affected devices include DVR model AHB7008T-MH-V2 and NVR model NBD7024H-P with the specified firmware. The vulnerability was discovered through static firmware analysis, reverse engineering, and emulation techniques.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an authenticated attacker to execute arbitrary commands on the affected device with root privileges by injecting shell metacharacters into the hostname configuration.

• Full control over the device's operating system environment.
• Potential to disrupt device functionality or cause denial of service.
• Ability to manipulate or exfiltrate sensitive data stored or processed by the device.
• Use of the compromised device as a foothold for further attacks within a network.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability occurs via an authenticated DVRIP protocol request on TCP port 34567 to the hostname configuration handler. Detection involves monitoring or testing for unauthorized or suspicious hostname configuration changes sent over TCP port 34567.

Since the vulnerability requires authentication and involves injection of shell metacharacters in the HostName value, detection can include checking for unusual or malformed hostname values containing shell metacharacters.

Specific commands to detect exploitation attempts are not provided in the available information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include preventing the use of shell invocation in the hostname configuration path.

• Replace system() calls with non-shell APIs such as sethostname() to avoid command injection.
• Implement strict allowlist validation of hostname input to reject invalid or malicious characters.
• Reject or escape shell metacharacters in hostname values as a defense-in-depth measure.

Useful 0 Not Useful 0