Critical · 9.3 CVE-2021-47707 EUVD-2021-34732GHSA-q6gq-vxg6-9m9p

COMMAX CVD-Axx DVR Weak Default Credentials Stream Disclosure

Published Dec 9, 2025 · Updated Apr 7, 2026 · Assigned by VulnCheck

Vendor: COMMAX Product: COMMAX CVD-Axx DVR

Description

COMMAX CVD-Axx DVR 5.1.4 contains weak default administrative credentials that allow remote password attacks and disclose RTSP stream. Attackers can exploit this by sending a POST request with the 'passkey' parameter set to '1234', allowing them to access the web control panel.

Affected products

Vendor	Product	Affected	Fixed
COMMAX	COMMAX CVD-Axx DVR	CVD-AH04 DVR 4.4.1	—

References

ExploitDB-50210 exploit
Official Product Homepage product
Zero Science Lab Disclosure (ZSL-2021-5667) third-party-advisory
VulnCheck Advisory: COMMAX CVD-Axx DVR Weak Default Credentials Stream Disclosure third-party-advisory