# CVE-2025-57202: AVTECH DGM1104 Stored XSS in PwdGrp.cgi username field

Source: https://junglewise.ai/threats/cve-2025-57202-avtech-dgm1104-stored-xss-in-pwdgrp-cgi-username-field  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-03. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2025-57202 · Severity: medium · CVSS 6.1 · Published 2025-12-03

A security vulnerability exists in the web management interface of AVTECH DGM1104 IP cameras, which are used for video surveillance. An attacker can inject malicious code into the camera's user management settings, which could allow them to hijack the sessions of legitimate administrators or perform unauthorized actions when the settings page is viewed. This could lead to unauthorized access to the camera's video feed or configuration.

Technologies: [Avtech Dgm1104](https://junglewise.ai/threats/technologies/dgm1104), [Avtech Dgm1104 Firmware](https://junglewise.ai/threats/technologies/dgm1104-firmware). Vendors: [Avtech](https://junglewise.ai/threats/vendors/avtech).

## Quick answers

**Is CVE-2025-57202 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-57202 being exploited in the wild.

**How severe is CVE-2025-57202?** Medium severity, with a CVSS score of 6.1, published 3 December 2025.

**Which products and versions are affected?** Avtech Dgm1104 FullImg-1015-1004-1006-1003.

**Is there a fix for CVE-2025-57202?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-57202 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2025-57202?** Check whether you run Avtech Dgm1104 or Avtech Dgm1104 Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in the PwdGrp.cgi endpoint of AVTECH DGM1104 IP cameras. The root cause is improper neutralization of input in the username field during user creation. An attacker can inject a crafted payload into the username field; this script is then executed in the context of any user who subsequently visits the user list page in the web interface. While the NVD description suggests no preconditions, secondary research indicates this typically occurs during user creation, which may require authentication. Successful exploitation allows for arbitrary JavaScript execution, potentially leading to session hijacking or administrative credential theft.

## Affected products

- AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003

## Timeline

- 2025-05: disclosed: Vulnerability discovered by Lewis Patten
- 2025-12-03: advisory: CVE published and initial NVD entry created

## References

- [http://dmg1104.com/](http://dmg1104.com/)
- [https://github.com/xchg-rax-rax/vulnerability-research/tree/main/CVE-2025-57202](https://github.com/xchg-rax-rax/vulnerability-research/tree/main/CVE-2025-57202)

## Related threats

- [AVTECH IP Cameras authenticated command injection in SMB function](https://junglewise.ai/threats/cve-2025-57201-avtech-ip-cameras-authenticated-command-injection-in-smb-function)
- [AVTECH IP Cameras authenticated command injection in NetFailDetectD](https://junglewise.ai/threats/cve-2025-57199-avtech-ip-cameras-authenticated-command-injection-in)
- [AVTECH IP Cameras authenticated command injection in Machine.cgi](https://junglewise.ai/threats/cve-2025-57198-avtech-ip-cameras-authenticated-command-injection-in-machine-cgi)
- [AVTECH IP Cameras command injection in test_mail function](https://junglewise.ai/threats/cve-2025-57200-avtech-ip-cameras-command-injection-in-test-mail-function)