CVE-2025-34036: TVT TD-2108TS-CL Firmware RCE Vulnerability

CVE-2025-34036 Overview

CVE-2025-34036 is an OS command injection vulnerability affecting white-labeled DVRs manufactured by TVT. The vulnerability exists in a custom HTTP service called "Cross Web Server" that listens on TCP ports 81 and 82. The web interface fails to sanitize input in the URI path passed to the language extraction functionality, allowing unauthenticated remote attackers to inject arbitrary shell commands and achieve command execution as root.

When the server processes a request to /language/[lang]/index.html, it uses the [lang] input unsafely in a tar extraction command without proper escaping. This critical flaw enables complete device compromise without any authentication requirements.

Critical Impact

Unauthenticated remote attackers can execute arbitrary commands as root on affected DVR devices, potentially compromising surveillance infrastructure and enabling lateral movement within networks.

Affected Products

• TVT TD-2108TS-CL and TD-2108TS-CL-A Series DVRs
• TVT TD-2116TS-CL, TD-2104TS-HC, TD-2108TS-HC, TD-2116TS-HC Series DVRs
• TVT TD-2104TS-HP, TD-2108TS-HP, TD-2116TE-HP Series DVRs
• TVT TD-2704TS-HC, TD-2708TS-HC, TD-2716TE-HC Series DVRs
• TVT TD-2716TC-HC, TD-2732TC-HC, TD-2716TD-HC, TD-2732TD-HC Series DVRs
• TVT TD-2704TS-HP, TD-2708TS-HP, TD-2708TE-HP, TD-2716TE-HP Series DVRs
• TVT TD-2716TC-HP, TD-2708TE-HK, TD-2932TD-HP Series DVRs
• TVT TD-2004TS-CL, TD-2004TS-CL-C, TD-2104TS-CL, TD-2104TS-CL-A Series DVRs
• TVT TD-2008TS-CL Series DVRs

Discovery Timeline

• 2025-02-06 - Exploitation evidence observed by the Shadowserver Foundation
• 2025-06-24 - CVE CVE-2025-34036 published to NVD
• 2025-11-20 - Last updated in NVD database

Technical Details for CVE-2025-34036

Vulnerability Analysis

This OS command injection vulnerability (CWE-78) exists in the "Cross Web Server" HTTP service running on affected TVT DVR devices. The service listens on non-standard ports (TCP 81 and 82) and provides a web-based management interface for the DVR systems.

The vulnerability occurs in the language selection functionality of the web interface. When a user requests a localized version of the interface, the server processes requests to the /language/[lang]/index.html endpoint. The [lang] parameter, which should contain a language code, is passed directly to a shell command that performs tar extraction operations without any input sanitization or escaping.

Because the service runs with root privileges on the embedded Linux system, successful exploitation grants attackers complete control over the DVR device. This is particularly concerning for surveillance infrastructure, as compromised DVRs could be used to disable recording, exfiltrate sensitive video footage, or serve as a pivot point for attacks against other networked systems.

Root Cause

The root cause is improper input validation in the language extraction functionality of the Cross Web Server. The application directly incorporates user-supplied input from the URI path into a shell command without sanitizing special characters or validating that the input conforms to expected language code formats. This allows shell metacharacters and command separators to be interpreted by the underlying shell, enabling arbitrary command execution.

Attack Vector

The attack is conducted over the network by sending specially crafted HTTP requests to TCP port 81 or 82 on vulnerable DVR devices. An attacker can inject shell commands by manipulating the language path parameter in requests to the /language/ endpoint. Since the vulnerability requires no authentication, any network-accessible DVR running the vulnerable firmware is at risk.

The exploitation technique involves inserting shell metacharacters (such as semicolons, backticks, or command substitution syntax) into the language parameter. When the server processes the request and executes the tar command with the unsanitized input, the injected commands are executed with root privileges.

For detailed technical information regarding exploitation techniques, refer to the VulnCheck Security Advisory, KerneronSec Research, and Exploit-DB #39596.

Detection Methods for CVE-2025-34036

Indicators of Compromise

• Unusual HTTP requests to ports 81 or 82 containing shell metacharacters in the URI path
• Requests to /language/ endpoints with unexpected characters such as semicolons, backticks, or pipe characters
• Evidence of shell command execution in DVR system logs or unexpected outbound network connections from DVR devices
• Unauthorized processes running on DVR devices or modifications to system files

Detection Strategies

• Deploy network intrusion detection rules to identify HTTP requests to ports 81/82 containing command injection patterns in URI paths
• Monitor for HTTP requests matching the pattern /language/.*[;|$(){}]` targeting DVR management interfaces
• Implement web application firewall rules to block requests containing shell metacharacters in URL path segments
• Correlate traffic patterns to known TVT DVR devices with anomalous command-and-control communications

Monitoring Recommendations

• Establish baseline network behavior for DVR devices and alert on deviations, particularly outbound connections to unfamiliar destinations
• Monitor for scanning activity targeting TCP ports 81 and 82 across the network
• Implement logging for all HTTP requests to DVR management interfaces and review for suspicious patterns
• Track firmware versions on all TVT DVR devices and maintain an inventory of potentially vulnerable systems

How to Mitigate CVE-2025-34036

Immediate Actions Required

• Isolate affected TVT DVR devices from the internet immediately by removing port forwarding rules and disabling external access
• Segment DVR devices onto a dedicated VLAN with strict firewall rules limiting access to authorized management stations only
• Disable or block access to TCP ports 81 and 82 from untrusted networks using firewall rules
• Conduct forensic analysis on any DVR devices that may have been exposed to determine if compromise has occurred

Patch Information

Contact TVT directly for firmware updates that address this vulnerability. Monitor the VulnCheck Security Advisory for updated remediation guidance. Organizations should verify firmware versions on all deployed TVT DVR devices and prioritize updates for any internet-exposed systems.

Workarounds

• Place all affected DVR devices behind a VPN to ensure only authenticated users can reach the management interface
• Implement network access control lists (ACLs) to restrict access to ports 81 and 82 to specific authorized IP addresses
• Deploy a reverse proxy with input validation capabilities in front of DVR devices to filter malicious requests
• Consider replacing end-of-life or unsupported DVR models with actively maintained alternatives

# Example firewall rule to block external access to vulnerable ports
# For iptables-based systems
iptables -A INPUT -p tcp --dport 81 -j DROP
iptables -A INPUT -p tcp --dport 82 -j DROP

# Allow access only from management network (example: 192.168.10.0/24)
iptables -A INPUT -s 192.168.10.0/24 -p tcp --dport 81 -j ACCEPT
iptables -A INPUT -s 192.168.10.0/24 -p tcp --dport 82 -j ACCEPT