CVE-2025-10265: Digiever NVR OS Command Injection Flaw

CVE-2025-10265 Overview

CVE-2025-10265 is an OS Command Injection vulnerability [CWE-78] affecting certain Network Video Recorder (NVR) models manufactured by Digiever. Authenticated remote attackers can inject arbitrary operating system commands and execute them on the device. The flaw is reachable over the network and requires only low-level privileges, making it accessible to any user with valid credentials on the NVR management interface.

The vulnerability was disclosed through Taiwan's National Computer Emergency Response Team (TWNCERT). Successful exploitation grants the attacker the ability to run commands in the context of the NVR's underlying operating system, exposing video data and providing a foothold inside surveillance networks.

Critical Impact
Authenticated attackers can achieve full command execution on affected Digiever NVR devices, compromising confidentiality, integrity, and availability of recorded surveillance data.

Affected Products

Digiever NVR (specific models identified in TWNCERT advisory)
Firmware versions referenced in the TWNCERT security bulletin
Network Video Recorder management web interface

Discovery Timeline

2025-09-12 - CVE-2025-10265 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10265

Vulnerability Analysis

The vulnerability is classified under [CWE-78] Improper Neutralization of Special Elements used in an OS Command. The affected Digiever NVR firmware accepts user-controlled input through an authenticated interface and passes that input to an operating system shell without adequate sanitization or argument quoting. Attackers can append shell metacharacters such as ;, |, &, or backticks to legitimate request parameters to break out of the intended command context.

Because NVR devices typically run with elevated privileges to manage storage, network interfaces, and camera streams, command execution often results in full device compromise. The attacker can read recorded footage, alter retention policies, disable logging, or pivot to other systems in the surveillance VLAN.

Root Cause

The root cause is the construction of OS shell commands using concatenated user input without using safe APIs or input validation. Functions such as system(), popen(), or shell-invoking wrappers process attacker-controlled strings directly, allowing metacharacter injection.

Attack Vector

The attack vector is network-based and requires authentication at the privilege level of a standard NVR user. After logging in, the attacker submits a crafted HTTP request to a vulnerable endpoint. The injected payload is interpreted by the device shell and executed with the privileges of the web service process. No user interaction is required beyond the attacker's own authenticated session.

No verified public proof-of-concept code is currently available. Technical details are described in the TWNCERT Security Advisory and the TWNCERT Incident Report.

Detection Methods for CVE-2025-10265

Indicators of Compromise

HTTP requests to NVR management endpoints containing shell metacharacters such as ;, |, &&, $(, or backticks in parameter values
Unexpected child processes spawned by the NVR web server, such as /bin/sh, wget, curl, nc, or busybox invocations
Outbound network connections from the NVR device to unfamiliar IP addresses, particularly to download secondary payloads
New cron jobs, startup scripts, or modified /etc/ configuration files on the device

Detection Strategies

Inspect web server and application logs on the NVR for request parameters containing command separators or URL-encoded shell metacharacters
Monitor authentication logs for low-privilege accounts that issue administrative or diagnostic requests immediately after login
Use network sensors to flag HTTP POST or GET requests to Digiever NVR endpoints containing suspicious payload patterns associated with command injection

Monitoring Recommendations

Place NVR devices on a segmented VLAN and capture north-south traffic for inspection by an intrusion detection system
Forward device syslog output to a centralized log platform and alert on shell command execution events originating from the web service user
Track outbound DNS and HTTP traffic from NVR appliances to detect command-and-control or payload retrieval activity

How to Mitigate CVE-2025-10265

Immediate Actions Required

Apply firmware updates released by Digiever for affected NVR models as soon as they are available from the vendor
Restrict access to the NVR management interface to trusted administrative networks using firewall rules or access control lists
Rotate all NVR user credentials and remove unused or default accounts to reduce the population of authenticated attackers
Audit existing NVR devices for signs of prior compromise, including unauthorized accounts and modified startup scripts

Patch Information

Refer to the TWNCERT Security Advisory for the list of affected models and the corresponding fixed firmware versions published by Digiever. Apply the patched firmware according to the vendor's upgrade procedure and verify the firmware version after the update completes.

Workarounds

Block external access to the NVR web interface and require VPN access for remote administration
Enforce strong, unique passwords for all NVR accounts and disable any guest or low-privilege accounts that do not require interactive access
Disable remote management features that are not strictly required for operations
Monitor the device for anomalous process execution until firmware patches are applied

bash

# Example firewall restriction limiting NVR management access to an admin subnet
iptables -A INPUT -p tcp --dport 80 -s 10.10.50.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 10.10.50.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP