CVE-2025-0224: Provision-ISR Devices Info Disclosure Flaw

CVE-2025-0224 Overview

CVE-2025-0224 is an information disclosure vulnerability affecting multiple Provision-ISR digital video recorder (DVR) and network video recorder (NVR) models running firmware up to build 20241220. The flaw resides in the /server.js file and allows unauthenticated remote attackers to retrieve sensitive device information over the network. Public disclosure of the exploit means threat actors can leverage it against exposed devices without prior credentials or user interaction. The vulnerability is tracked under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact
Remote unauthenticated attackers can extract sensitive device information from affected Provision-ISR surveillance appliances, aiding reconnaissance and follow-on attacks against video surveillance infrastructure.

Affected Products

Provision-ISR SH-4050A-2, SH-4100A-2L(MM), and SH-8100A-2L(MM) DVRs up to firmware 20241220
Provision-ISR SH-16200A-2(1U) and SH-16200A-5(1U) DVRs up to firmware 20241220
Provision-ISR NVR5-8200PX up to firmware 20241220

Discovery Timeline

2025-01-05 - CVE-2025-0224 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0224

Vulnerability Analysis

The vulnerability exists in an unknown handler within the /server.js file on the embedded web management interface of the affected Provision-ISR appliances. When a remote client interacts with this endpoint, the device returns sensitive information without enforcing authentication or authorization checks. The exposed data can include device identifiers, configuration parameters, and other operational details useful to an attacker profiling the target. Because the endpoint is exposed over the network stack of the appliance, no local access is required to trigger the disclosure.

Root Cause

The root cause is missing access control on a server-side JavaScript endpoint that returns device metadata. The handler in /server.js does not validate the requester before serving privileged information, which aligns with the CWE-200 classification. Embedded surveillance devices commonly ship with lightweight HTTP services that prioritize functionality over authentication hardening, and this endpoint reflects that pattern.

Attack Vector

An attacker sends a crafted HTTP request to the /server.js resource of a reachable Provision-ISR device. No credentials, tokens, or user interaction are needed. The response contains sensitive device information that attackers can use to identify firmware versions, chain additional weaknesses, or plan credential-stuffing and lateral movement operations. Devices exposed directly to the internet through port forwarding or misconfigured firewalls are the primary targets. Refer to the NetSecFish Security Analysis for the technical write-up.

Detection Methods for CVE-2025-0224

Indicators of Compromise

Unauthenticated HTTP GET requests to /server.js on Provision-ISR DVR and NVR management interfaces
Outbound responses from surveillance appliances containing device identifiers or configuration fields to unfamiliar external IP addresses
Repeated scanning patterns targeting TCP ports commonly used by Provision-ISR web services from a single source

Detection Strategies

Inspect web server and reverse proxy logs on surveillance appliances for requests to /server.js originating from non-management networks.
Deploy network intrusion detection signatures that flag HTTP requests to /server.js where the User-Agent or source does not match approved management stations.
Correlate scanning activity against IoT reconnaissance patterns using an XDR or SIEM platform capable of parsing embedded device telemetry.

Monitoring Recommendations

Enable NetFlow or packet capture on VLANs hosting CCTV infrastructure to identify anomalous HTTP traffic to management endpoints.
Alert on Provision-ISR devices communicating with external IP addresses outside of vendor update ranges.
Track device inventories against Shodan and Censys exposure to detect internet-facing surveillance devices in the organization's IP space.

How to Mitigate CVE-2025-0224

Immediate Actions Required

Remove Provision-ISR DVR and NVR appliances from direct internet exposure and place them behind a firewall or VPN concentrator.
Restrict access to the device web interface to a dedicated management VLAN with explicit allow-lists.
Audit device firmware versions against the affected list and prioritize isolation of any unit running 20241220 or earlier.

Patch Information

At the time of publication, no vendor advisory or firmware update from Provision-ISR is referenced in the NVD entry. Administrators should monitor the vendor support portal for firmware builds newer than 20241220 and apply them once available. Additional context is available in VulDB entry #290203.

Workarounds

Block inbound access to the /server.js endpoint at an upstream reverse proxy or web application firewall until a vendor patch is available.
Segment surveillance devices into an isolated network zone with no direct routing to corporate assets or the public internet.
Disable remote management features on affected DVR and NVR units where operational requirements permit.

bash

# Example iptables rule blocking external access to the Provision-ISR web interface
iptables -A INPUT -p tcp --dport 80 -s 0.0.0.0/0 -j DROP
iptables -A INPUT -p tcp --dport 80 -s 10.10.50.0/24 -j ACCEPT  # management VLAN only