CVE-2025-10265

HIGH

Digiever NVR < *.*.*.78 - Authenticated OS Command Injection

Title source: llm
STIX 2.1

Description

Certain models of NVR developed by Digiever has an OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the device.

References (2)

Core 2
Core References
Various Sources third-party-advisory
https://www.twcert.org.tw/tw/cp-132-10375-19f1e-1.html
Various Sources third-party-advisory
https://www.twcert.org.tw/en/cp-139-10376-a057c-2.html

Scores

CVSS v3 8.8
EPSS 0.0114
EPSS Percentile 62.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-78
Status published
Products (18)
Digiever/DS-1200 < *.*.*.78
Digiever/DS-16x00-RM Pro+ < *.*.*.78
Digiever/DS-16x00-RM UHD < *.*.*.78
Digiever/DS-2100 Pro < *.*.*.78
Digiever/DS-2100 Pro+ < *.*.*.78
Digiever/DS-2100 UHD < *.*.*.78
Digiever/DS-2200 UHD < *.*.*.78
Digiever/DS-2200 UHD+ < *.*.*.78
Digiever/DS-4100-RM < *.*.*.78
Digiever/DS-4200 Pro < *.*.*.78
... and 8 more
Published Sep 12, 2025
Tracked Since Feb 18, 2026