CCTV-DVR - RCE (CVE-2025-34036)
Description
An OS command injection vulnerability exists in white-labeled DVRs manufactured by TVT, affecting a custom HTTP service called "Cross Web Server" that listens on TCP ports 81 and 82. The web interface fails to sanitize input in the URI path passed to the language extraction functionality. When the server processes a request to /language/[lang]/index.html, it uses the [lang] input unsafely in a tar extraction command without proper escaping. This allows an unauthenticated remote attacker to inject shell commands and achieve arbitrary command execution as root. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.
psychologyCrowdSec Analysis
CVE-2025-34036 is a critical OS command injection vulnerability in Shenzhen TVT white-labeled CCTV-DVRs, specifically affecting the Cross Web Server HTTP service on ports 81 and 82. Due to improper input sanitization in the language extraction functionality, unauthenticated remote attackers can inject arbitrary shell commands via crafted URI paths, leading to root-level remote code execution. This flaw exposes affected DVRs to complete system compromise, enabling attackers to take full control, deploy malware, or pivot further into connected networks.
CrowdSec has been tracking this vulnerability and its exploits since 8th of April 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2025-34036 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit the /language/ endpoint by injecting shell commands (such as echo poc-content > /tmp/poc.txt) via the path parameter to achieve remote command execution on the server.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2025-06-24 |
| Rule Released | 2026-04-08 |
| CrowdSec First Seen | 2026-04-09 |