CVE-2025-57200: AVTECH IP Cameras command injection in test_mail function

CVE-2025-57200 · Severity: medium · CVSS 6.5 · Published 2025-12-03

A security vulnerability has been identified in several AVTECH IP cameras, which are used for video surveillance and security monitoring. An attacker with access to the camera's administrative interface can execute unauthorized commands on the device. This could allow a malicious actor to take full control of the camera, potentially leading to unauthorized surveillance, data theft, or using the device as a foothold to attack other parts of the corporate network.

Technologies: Avtech Dgm1104, Avtech Dgm1104 Firmware, AVTECH SECURITY Corporation AVM1203, AVTECH SECURITY Corporation AVM2200, AVTECH SECURITY Corporation AVM301. Vendors: Avtech, AVTECH SECURITY Corporation.

Quick answers

Is CVE-2025-57200 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-57200 being exploited in the wild.
How severe is CVE-2025-57200?
Medium severity, with a CVSS score of 6.5, published 3 December 2025.
Which products and versions are affected?
AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003; AVTECH SECURITY Corporation AVM1203; AVTECH SECURITY Corporation AVM2200; AVTECH SECURITY Corporation AVM301; and 3 more.
Is there a fix for CVE-2025-57200?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-57200 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-57200?
Check whether you run Avtech Dgm1104, Avtech Dgm1104 Firmware, AVTECH SECURITY Corporation AVC704H or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A post-authentication command injection vulnerability exists in the 'test_mail' function within the 'cgibox' binary of various AVTECH IP cameras. The vulnerability occurs because the device reads SMTP configuration settings from flash memory and integrates them into a string passed directly to the 'system()' function without proper sanitization. An authenticated attacker can exploit this by supplying maliciously crafted input to the web API, resulting in arbitrary command execution with root privileges. While the NVD entry lists DGM1104, security researchers have identified dozens of additional models (AVM, AVN, DGM, AVC, KPD, and AVX series) as potentially vulnerable based on firmware analysis.

Affected products

  • AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003
  • AVTECH SECURITY Corporation AVM1203
  • AVTECH SECURITY Corporation AVM2200
  • AVTECH SECURITY Corporation AVM301
  • AVTECH SECURITY Corporation AVN808
  • AVTECH SECURITY Corporation DGM1304
  • AVTECH SECURITY Corporation AVC704H

Timeline

  • 2025-05: disclosed: Vulnerability discovered by Lewis Patten
  • 2025-12-03: advisory: CVE published by NVD/MITRE

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.