CVE-2025-34065

AVTECH - Auth Bypass

Title source: llm

Description

An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr() function allows unauthenticated access to any request containing "/nobody" in the URL, bypassing login controls.

Exploits (1)

exploitdb WRITEUP

by Gergely Eberhardt · pythonwebappscgi

https://www.exploit-db.com/exploits/40500

View Code ZIP pw:eip

References (5)

[Various Sources] https://avtech.com/

[Third Party Advisory] https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns

[Various Sources] https://web.archive.org/web/20161029201749/https://github.com/ebux/AVTECH

[Various Sources] https://web.archive.org/web/20240810225729/https://www.search-lab.hu/advisories/126-AVTech-devices-multiple-vulnerabilities

[Exploit, Third Party Advisory] https://www.exploit-db.com/exploits/40500

Scores

EPSS 0.0012

EPSS Percentile 30.6%

Classification

CWE

CWE-290

Status draft

Timeline

Published Jul 01, 2025

Tracked Since Feb 18, 2026