CVE-2018-25126

Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 firmware (used by many white-labeled DVR/NVR/IPC products) contains hardcoded API credentials and an OS command injection flaw in its configuration services. The web/API interface accepts HTTP/XML requests authenticated with a fixed vendor credential string and passes user-controlled fields into shell execution contexts without proper argument sanitization. An unauthenticated remote attacker can leverage the hard-coded credential to access endpoints such as /editBlackAndWhiteList and inject shell metacharacters inside XML parameters, resulting in arbitrary command execution as root. The same vulnerable backend is also reachable in some models through a proprietary TCP service on port 4567 that accepts a magic GUID preface and base64-encoded XML, enabling the same command injection sink. Firmware releases from mid-February 2018 and later are reported to have addressed this issue. Exploitation evidence was observed by the Shadowserver Foundation on 2025-01-28 UTC.

• CWE-78
• CWE-798

• https://blogs.juniper.net/en-us/threat-research/iot-botnet-exploiting-tvt-shenzhen-dvrs-still-lingers
• https://github.com/mcw0/PoC/blob/master/TVT_and_OEM_IPC_NVR_DVR_RCE_Backdoor_and_Information_Disclosure.txt
• https://qkl.seebug.org/vuldb/ssvid-97217
• https://web.archive.org/web/20180614014914/http://en.tvt.net.cn:80/news/227.html
• https://www.vulncheck.com/advisories/tvt-nvms9000-hardcoded-api-credentials-and-command-injection

Published

Nov 24, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-25120D-Link DNS-343 ShareCenter devices running firmware versions…9.8
• CVE-2018-25121Nagios XI versions prior to 5.4.13 are vulnerable to cross-s…5.4
• CVE-2018-25122Nagios XI versions prior to 5.4.13 contain a remote code exe…8.8
• CVE-2018-25123Nagios XI versions prior to 5.5.7 contain a privilege escala…7.8
• CVE-2018-25124PacsOne Server version 6.6.2 (prior versions are likely affe…8.7
• CVE-2018-25125Netis ADSL Router DL4322D firmware RTK 2.1.1 contains a buff…8.7
• CVE-2018-25127SOCA Access Control System 180612 contains a cross-site requ…5.3
• CVE-2018-25128SOCA Access Control System 180612 contains multiple SQL inje…9.3
• CVE-2018-25129SOCA Access Control System 180612 contains multiple insecure…7.5
• CVE-2018-25130Beward Intercom 2.3.1 contains a credentials disclosure vuln…6.8
• CVE-2018-25131Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 contains …7.2
• CVE-2018-25132MyBB Trending Widget Plugin 1.2 contains a cross-site script…6.1