Shenzhen TVT Digital Technology Co., Ltd. Vulnerabilities and Affected Products
Explore source-attributed vulnerabilities associated with Shenzhen TVT Digital Technology Co., Ltd. products.
Products
- NVMS-90002 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2024-14007HIGH | TVT NVMS-9000 < 1.3.4 Unauthenticated Administrative Queries & Information DisclosureShenzhen TVT Digital Technology Co., Ltd. NVMS-9000 firmware (used by many white-labeled DVR/NVR/IPC products) versions prior to 1.3.4 contain an authentication bypass in the NVMS-9000 control protocol. By sending a single crafted TCP payload to an exposed NVMS-9000 control port, an unauthenticated remote attacker can invoke privileged administrative query commands without valid credentials. Successful exploitation discloses sensitive information including administrator usernames and passwords i… CWE-306Nov 24, 2025 | CVSS8.7v4.0 | EPSS0.859% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2018-25126CRITICAL | TVT NVMS-9000 Hard-coded API Credentials & Command InjectionShenzhen TVT Digital Technology Co., Ltd. NVMS-9000 firmware (used by many white-labeled DVR/NVR/IPC products) contains hardcoded API credentials and an OS command injection flaw in its configuration services. The web/API interface accepts HTTP/XML requests authenticated with a fixed vendor credential string and passes user-controlled fields into shell execution contexts without proper argument sanitization. An unauthenticated remote attacker can leverage the hard-coded credential to access endp… | CVSS9.3v4.0 | EPSS4.13% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |