# CVE-2025-34036: CCTV-DVR - RCE

> Live exploitation tracking for CVE-2025-34036 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-34036

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 10.0
- **Public exploit available:** Yes
- **Affected products:** Shenzhen TVT CCTV-DVR
- **Weaknesses:** CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
- **Tags:** iot

## Description

An OS command injection vulnerability exists in white-labeled DVRs manufactured by TVT, affecting a custom HTTP service called "Cross Web Server" that listens on TCP ports 81 and 82. The web interface fails to sanitize input in the URI path passed to the language extraction functionality. When the server processes a request to /language/[lang]/index.html, it uses the [lang] input unsafely in a tar extraction command without proper escaping. This allows an unauthenticated remote attacker to inject shell commands and achieve arbitrary command execution as root. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC.

## CrowdSec analysis

[CVE-2025-34036](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-34036) is a critical OS command injection vulnerability in Shenzhen TVT white-labeled CCTV-DVRs, specifically affecting the Cross Web Server HTTP service on ports 81 and 82. Due to improper input sanitization in the language extraction functionality, unauthenticated remote attackers can inject arbitrary shell commands via crafted URI paths, leading to root-level remote code execution. This flaw exposes affected DVRs to complete system compromise, enabling attackers to take full control, deploy malware, or pivot further into connected networks.

CrowdSec has been tracking this vulnerability and its exploits since 8th of April 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2025-34036 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the `/language/` endpoint by injecting shell commands (such as `echo poc-content > /tmp/poc.txt`) via the path parameter to achieve remote command execution on the server.

## Timeline

- 2025-06-24: CVE Published. CVE-2025-34036 is published to NVD.
- 2026-04-08: Rule Released. CrowdSec releases a rule to detect CVE-2025-34036 exploitation attempts against the CrowdSec Network.
- 2026-04-09: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-34036 for the first time.

## References

- https://web.archive.org/web/20160322204109/http://www.kerneronsec.com/2016/02/remote-code-execution-in-cctv-dvrs-of.html
- https://vulncheck.com/advisories/shenzhen-tvt-cctv-dvr-command-injection
- https://github.com/rix4uni/cvemapping/blob/main/2025/CVE-2025-34036/app.py

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-34036) follows observed exploitation activity for CVE-2025-34036. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.