CVE-2025-10264: Digiever NVR Information Disclosure Flaw

CVE-2025-10264 Overview

CVE-2025-10264 is a sensitive information disclosure vulnerability affecting certain Network Video Recorder (NVR) models manufactured by Digiever. Unauthenticated remote attackers can retrieve the system configuration file and extract plaintext credentials for both the NVR and any cameras connected to it. The flaw is categorized under [CWE-497] (Exposure of Sensitive System Information to an Unauthorized Control Sphere). Because authentication is not required and the credentials are stored in plaintext, attackers can pivot from a single network-reachable device into the entire surveillance infrastructure.

Critical Impact
Unauthenticated remote attackers can read configuration files containing plaintext credentials, leading to full compromise of the NVR and all attached IP cameras.

Affected Products

Digiever NVR (certain models — see vendor advisory for the affected model list)
Connected IP cameras managed by the affected NVR (credentials exposed via the NVR configuration)
Surveillance deployments exposing the NVR web interface to untrusted networks

Discovery Timeline

2025-09-12 - CVE-2025-10264 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-10264

Vulnerability Analysis

The vulnerability resides in the NVR's web-facing service, which exposes the system configuration file without enforcing authentication. An attacker who can reach the NVR over the network can request the configuration resource directly and receive its contents in clear form. The configuration includes administrative credentials for the NVR itself as well as credentials used by the NVR to authenticate to its connected cameras. Because the credentials are stored in plaintext rather than hashed or encrypted, no offline cracking is needed. The attacker immediately obtains usable passwords for downstream devices.

Root Cause

The root cause is a combination of two design weaknesses. First, the configuration endpoint lacks an access control check, allowing unauthenticated retrieval. Second, the configuration format stores sensitive secrets without any cryptographic protection. Together these conditions map directly to [CWE-497].

Attack Vector

Exploitation is performed remotely over the network with no user interaction and no prior credentials. An attacker locates a Digiever NVR on a reachable network, issues a single request to the exposed configuration resource, and parses the response for credential fields. With those credentials, the attacker authenticates to the NVR management interface, accesses live and recorded video, and connects to each linked IP camera. No exploitation code is required beyond a standard HTTP client. See the TWCERT Advisory #10376 for vendor-confirmed technical details.

Detection Methods for CVE-2025-10264

Indicators of Compromise

Unauthenticated HTTP/HTTPS requests to NVR configuration paths originating from external or unexpected internal IP addresses.
Successful administrative logins to the NVR or connected cameras from IP addresses outside the normal management subnet.
Unusual outbound connections from the NVR or cameras following configuration file access.

Detection Strategies

Inspect web server access logs on the NVR for requests to configuration-related URIs that return non-error responses without a prior authenticated session.
Correlate NVR configuration retrieval events with subsequent admin login activity to identify credential reuse following the disclosure.
Deploy network IDS signatures that flag requests to the affected endpoint described in the TWCERT advisories.

Monitoring Recommendations

Continuously monitor management traffic to and from NVRs and IP cameras and alert on any administrative access outside approved jump hosts.
Track configuration changes and new RTSP or ONVIF session sources on connected cameras to detect lateral movement.
Forward NVR and camera logs to a centralized SIEM for retention and cross-device correlation.

How to Mitigate CVE-2025-10264

Immediate Actions Required

Remove NVR management interfaces from the public internet and restrict access to a dedicated management VLAN.
Rotate all administrative passwords on the NVR and on every camera whose credentials were stored in the NVR configuration, assuming prior exposure.
Apply the firmware update referenced in the TWCERT Advisory #10375 once available for the affected model.
Audit recent NVR access logs for evidence of unauthenticated configuration retrieval.

Patch Information

Digiever has coordinated disclosure through TWCERT. Refer to the TWCERT Advisory #10376 and TWCERT Advisory #10375 for the list of affected models and the corresponding firmware versions that remediate the issue. Apply the fixed firmware to all affected devices.

Workarounds

Place affected NVRs behind a firewall or VPN so the web interface is unreachable from untrusted networks until firmware is patched.
Enforce strict source-IP allow lists on any network device fronting the NVR to limit who can issue HTTP requests to it.
Segment IP cameras onto an isolated VLAN with no route to the corporate network or internet beyond the NVR itself.

bash

# Example: restrict NVR management access with iptables on an upstream gateway
iptables -A FORWARD -p tcp -d <NVR_IP> --dport 80  -s <MGMT_SUBNET> -j ACCEPT
iptables -A FORWARD -p tcp -d <NVR_IP> --dport 443 -s <MGMT_SUBNET> -j ACCEPT
iptables -A FORWARD -p tcp -d <NVR_IP> --dport 80  -j DROP
iptables -A FORWARD -p tcp -d <NVR_IP> --dport 443 -j DROP