High · 8.3 CVE-2025-34066 EUVD-2025-19640GHSA-4cx5-3q2w-5wr7

AVTECH IP camera, DVR, and NVR Devices Unauthenticated Information Disclosure

Published Jul 1, 2025 · Updated Apr 7, 2026 · Assigned by VulnCheck

Vendor: AVTECH Product: DVR devices Product: IP cameras Product: NVR devices

Description

An improper certificate validation vulnerability exists in AVTECH IP cameras, DVRs, and NVRs due to the use of wget with --no-check-certificate in scripts like SyncCloudAccount.sh and SyncPermit.sh. This exposes HTTPS communications to man-in-the-middle (MITM) attacks.

Affected products

Vendor	Product	Affected	Fixed
AVTECH	IP cameras	—	—
AVTECH	DVR devices	—	—
AVTECH	NVR devices	—	—

References

https://www.exploit-db.com/exploits/40500 exploit
https://avtech.com/ product
https://web.archive.org/web/20240810225729/https://www.search-lab.hu/advisories/126-AVTech-devices-multiple-vulnerabilities third-party-advisory technical-description
https://web.archive.org/web/20161029201749/https://github.com/ebux/AVTECH exploit
https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns third-party-advisory