Executive brief
AVTECH IP cameras contain a security flaw in their network connectivity testing feature. An authenticated user can provide specially crafted input that allows them to take full control of the camera as a root user. This could lead to unauthorized surveillance, data theft, or the device being used as a foothold to attack other parts of the corporate network.
Technical details
A command injection vulnerability exists in the NetFailDetectD binary of various AVTECH IP cameras. The vulnerability is rooted in the improper neutralization of special elements (CWE-77) within the network failure detection functionality. The binary reads the hostname configuration directly from stored settings and passes it to the popen function without sanitization to perform connectivity pings. An authenticated attacker with access to the web management interface can supply a malicious hostname containing shell metacharacters to achieve arbitrary code execution as the root user. While the advisory specifically highlights DGM1104 firmware FullImg-1015-1004-1006-1003, analysis indicates dozens of other AVM, AVN, and DGM series models are likely affected.
Affected products
- AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003
- AVTECH SECURITY Corporation AVM1203
- AVTECH SECURITY Corporation AVM2200
- AVTECH SECURITY Corporation AVM301
- AVTECH SECURITY Corporation AVN2503
- AVTECH SECURITY Corporation AVX931A
Timeline
- 2025-05: disclosed: Vulnerability discovered by Lewis Patten
- 2025-12-03: advisory: CVE published by NVD/MITRE