CVE-2025-34043 json
Vacron NVR Remote Command Execution
published 2025-06-26 16 mo ago modified 2026-07-14 3 mo ago also EUVD-2025-19211
- cvss
- 10.0
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 7.5%
- EPSS 7.5% chance of exploitation in 30 days, percentile 94%
- public exploits
- 0
- none known
Summary
A remote command injection vulnerability exists in Vacron Network Video Recorder (NVR) devices v1.4 due to improper input sanitization in the board.cgi script. The vulnerability allows unauthenticated attackers to pass arbitrary commands to the underlying operating system via crafted HTTP requests. These commands are executed with the privileges of the web server process, enabling remote code execution and potential full device compromise. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- total
- Assessed
- 10 mo ago
Exploit prediction
7.51% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- ssd-disclosure.com https://ssd-disclosure.com/ssd-advisory-vacron-nvr-remote-command-execution/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 10.0 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
| CNA | 4.0 | 10.0 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- Vacron Network Video Recorder (NVR)
Classification
References
-
ssd-disclosure.com
/ssd-advisory-vacron-nvr-remote-command-execution/
third-party-advisory, exploit
-
tenable.com
/plugins/nessus/104124
third-party-advisory
-
sonicwall.com
/blog/vacron-network-video-recorder-remote-command-execution
third-party-advisory, signature, technical-description
-
broadcom.com
/support/security-center/attacksignatures/detail?asid=30386
third-party-advisory
-
vulncheck.com
/advisories/vacron-nvr-remote-command-execution
third-party-advisory
-
vacron.com
/
product
Sources
- CVE List CVE-2025-34043
- NVD CVE-2025-34043
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.