# CVE-2025-57198: AVTECH IP Cameras authenticated command injection in Machine.cgi

Source: https://junglewise.ai/threats/cve-2025-57198-avtech-ip-cameras-authenticated-command-injection-in-machine-cgi  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-03. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2025-57198 · Severity: high · CVSS 8.8 · Published 2025-12-03

A security vulnerability has been identified in several AVTECH IP camera models, which are used for video surveillance and security monitoring. An attacker with valid login credentials can exploit a flaw in the camera's web interface to take full control of the device. This could allow an unauthorized user to disrupt video feeds, access sensitive recordings, or use the camera as a foothold to attack other parts of the corporate network.

Technologies: [Avtech Dgm1104](https://junglewise.ai/threats/technologies/dgm1104), [Avtech Dgm1104 Firmware](https://junglewise.ai/threats/technologies/dgm1104-firmware), [AVTECH SECURITY Corporation AVM1203](https://junglewise.ai/threats/technologies/avm1203), [AVTECH SECURITY Corporation AVM2200](https://junglewise.ai/threats/technologies/avm2200). Vendors: [Avtech](https://junglewise.ai/threats/vendors/avtech), [AVTECH SECURITY Corporation](https://junglewise.ai/threats/vendors/avtech-security-corporation).

## Quick answers

**Is CVE-2025-57198 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-57198 being exploited in the wild.

**How severe is CVE-2025-57198?** High severity, with a CVSS score of 8.8, published 3 December 2025.

**Which products and versions are affected?** AVTECH SECURITY Corporation DGM1104 firmware FullImg-1015-1004-1006-1003 FullImg-1015-1004-1006-1003; AVTECH SECURITY Corporation AVM1203; AVTECH SECURITY Corporation AVM2200; AVTECH SECURITY Corporation AVN815EZ; and 1 more.

**Is there a fix for CVE-2025-57198?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-57198 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-57198?** Check whether you run Avtech Dgm1104, Avtech Dgm1104 Firmware, AVTECH SECURITY Corporation AVM1203 or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A post-authentication command injection vulnerability exists in the 'Machine.cgi' endpoint of various AVTECH IP cameras. The flaw is located within the FTP test functionality in the 'cgibox' binary. The application fails to sanitize FTP configuration settings retrieved from flash memory before passing them to the 'system()' function. An authenticated attacker can provide maliciously crafted input to the web API to execute arbitrary commands with root privileges. While the advisory highlights the DGM1104 model, analysis of firmware images suggests dozens of other models in the AVM, AVN, DGM, AVC, and KPD series are also affected.

## Affected products

- AVTECH SECURITY Corporation DGM1104 firmware FullImg-1015-1004-1006-1003 FullImg-1015-1004-1006-1003
- AVTECH SECURITY Corporation AVM1203
- AVTECH SECURITY Corporation AVM2200
- AVTECH SECURITY Corporation AVN815EZ
- AVTECH SECURITY Corporation DGM1304QS

## Timeline

- 2025-12-03: disclosed
- 2025-12-03: advisory

## References

- [http://dgm1104.com/](http://dgm1104.com/)
- [https://github.com/xchg-rax-rax/vulnerability-research/tree/main/CVE-2025-57198](https://github.com/xchg-rax-rax/vulnerability-research/tree/main/CVE-2025-57198)

## Related threats

- [AVTECH DGM1104 Stored XSS in PwdGrp.cgi username field](https://junglewise.ai/threats/cve-2025-57202-avtech-dgm1104-stored-xss-in-pwdgrp-cgi-username-field)
- [AVTECH IP Cameras authenticated command injection in SMB function](https://junglewise.ai/threats/cve-2025-57201-avtech-ip-cameras-authenticated-command-injection-in-smb-function)
- [AVTECH IP Cameras authenticated command injection in NetFailDetectD](https://junglewise.ai/threats/cve-2025-57199-avtech-ip-cameras-authenticated-command-injection-in)
- [AVTECH IP Cameras command injection in test_mail function](https://junglewise.ai/threats/cve-2025-57200-avtech-ip-cameras-command-injection-in-test-mail-function)