CVE-2024-14007: NVMS-9000 Authentication Bypass Flaw

CVE-2024-14007 Overview

CVE-2024-14007 is an authentication bypass vulnerability in Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 firmware versions prior to 1.3.4. The NVMS-9000 protocol is embedded in a wide range of white-labeled DVR, NVR, and IP camera (IPC) products distributed globally. A single crafted TCP payload sent to an exposed NVMS-9000 control port allows an unauthenticated remote attacker to invoke privileged administrative query commands. Successful exploitation discloses administrator usernames and passwords in cleartext, along with network, email, PPPoE, and FTP configuration. The flaw is tracked under [CWE-306: Missing Authentication for Critical Function].

Critical Impact
Unauthenticated remote attackers can extract administrator credentials in cleartext from exposed NVMS-9000 devices using a single TCP request, enabling full device takeover and downstream network access.

Affected Products

Shenzhen TVT Digital Technology NVMS-9000 firmware versions prior to 1.3.4
White-labeled DVR, NVR, and IPC products incorporating the NVMS-9000 control protocol
Internet-exposed devices listening on the NVMS-9000 control port

Discovery Timeline

2025-11-24 - CVE-2024-14007 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-14007

Vulnerability Analysis

The NVMS-9000 control protocol exposes a set of administrative query commands over TCP. These commands include queryBasicCfg, queryUserList, queryEmailCfg, queryPPPoECfg, and queryFTPCfg. The protocol handler fails to verify the caller's authentication state before executing these commands. An attacker who can reach the control port can request configuration data without presenting credentials.

The response payload returns administrator usernames and passwords in cleartext. Network configuration, mail relay credentials, PPPoE credentials, and FTP credentials are also disclosed. Attackers can pivot from a single information disclosure to full administrative login on the device and to upstream services that share the leaked credentials.

Root Cause

The root cause is missing authentication on critical functions [CWE-306]. The NVMS-9000 firmware accepts administrative query commands on the control protocol channel and processes them without invoking any session, token, or credential check. The design also stores credentials in a reversible or cleartext form so the response handler can return them on request.

Attack Vector

The attack vector is the network. An attacker sends a single crafted TCP payload to the NVMS-9000 control port on a reachable device. No prior credentials, user interaction, or local access are required. Public reporting from GreyNoise and the UnderCode Testing blog describes Mirai-variant botnets, including Eleven11, scanning for and exploiting exposed devices. Technical command-level details are documented in the SSD Disclosure Advisory and the VulnCheck Advisory.

Detection Methods for CVE-2024-14007

Indicators of Compromise

Inbound TCP connections to NVMS-9000 control ports from untrusted networks containing the strings queryBasicCfg, queryUserList, queryEmailCfg, queryPPPoECfg, or queryFTPCfg.
Outbound responses from DVR, NVR, or IPC devices that contain cleartext credential fields to external hosts.
New administrative logins to DVR, NVR, or IPC management interfaces from previously unseen IP addresses following scan activity.
Mirai-variant botnet beaconing from devices identified by GreyNoise as exploiting TVT DVRs.

Detection Strategies

Deploy network signatures on perimeter sensors that match the ASCII command tokens used in NVMS-9000 queries against unauthenticated sessions.
Inventory exposed DVR, NVR, and IPC assets using passive asset discovery and correlate against firmware versions below 1.3.4.
Hunt for credential reuse alerts that map leaked DVR administrator passwords to other corporate accounts.

Monitoring Recommendations

Monitor egress traffic from physical security and surveillance VLANs for unexpected TCP flows to internet hosts.
Alert on configuration change events on NVMS-9000 devices that follow inbound traffic from external sources.
Review firewall logs for scanning patterns targeting common NVMS-9000 ports and block source ranges identified in threat intelligence feeds.

How to Mitigate CVE-2024-14007

Immediate Actions Required

Identify all DVR, NVR, and IPC devices that use the NVMS-9000 protocol, including white-labeled hardware from non-TVT brands.
Remove direct internet exposure of NVMS-9000 control ports by placing devices behind firewalls or VPN gateways.
Rotate administrator credentials on all affected devices and any external services whose credentials were stored on the device (SMTP, PPPoE, FTP).
Treat devices that were internet-exposed prior to mitigation as compromised and audit network segments they could reach.

Patch Information

Shenzhen TVT Digital Technology has released firmware version 1.3.4 of NVMS-9000 to address the missing authentication check. Operators should upgrade to 1.3.4 or later. White-label resellers may distribute the fix under different version strings, so confirm the patch with the device vendor referencing CVE-2024-14007.

Workarounds

Restrict access to the NVMS-9000 control port to trusted management subnets using firewall ACLs.
Place surveillance equipment on an isolated VLAN with no outbound internet access except to defined update endpoints.
Disable remote management features and Universal Plug and Play (UPnP) port forwarding on upstream routers.
Replace devices that cannot be patched and remain reachable from untrusted networks.

bash

# Example iptables rule restricting NVMS-9000 control port to a management subnet
iptables -A INPUT -p tcp --dport 34567 -s 10.10.50.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 34567 -j DROP