CVE-2025-7723: VIGI NVR Auth Bypass Vulnerability

CVE-2025-7723 Overview

CVE-2025-7723 is an authenticated command injection vulnerability affecting TP-Link VIGI Network Video Recorder (NVR) devices. The flaw impacts VIGI NVR1104H-4P V1 before firmware 1.1.5 Build 250518 and VIGI NVR2016H-16MP V2 before firmware 1.3.1 Build 250407. An authenticated attacker on an adjacent network can inject operating system commands, leading to full compromise of the device. The vulnerability is categorized under CWE-78, Improper Neutralization of Special Elements used in an OS Command.

Critical Impact
Successful exploitation grants attackers arbitrary OS command execution on the NVR, exposing recorded video, connected cameras, and network segments accessible to the device.

Affected Products

TP-Link VIGI NVR1104H-4P V1 (firmware before 1.1.5 Build 250518)
TP-Link VIGI NVR2016H-16MP V2 (firmware before 1.3.1 Build 250407)
TP-Link VIGI surveillance ecosystem components dependent on these NVRs

Discovery Timeline

2025-07-22 - CVE-2025-7723 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-7723

Vulnerability Analysis

The vulnerability resides in the web management interface of affected TP-Link VIGI NVR devices. After authenticating to the device, an attacker can supply crafted input to a management endpoint that fails to sanitize shell metacharacters. The device passes this input to an OS command interpreter, allowing arbitrary command execution in the context of the NVR firmware.

Because NVRs act as aggregation points for surveillance cameras, code execution on the appliance impacts the confidentiality, integrity, and availability of video streams and recordings. The device typically runs with elevated privileges on its embedded Linux platform, giving attackers broad control over storage, network interfaces, and connected IP cameras. See the TP-Link FAQ Document for vendor guidance.

Root Cause

The root cause is missing or insufficient input validation on a parameter processed by a system-level command call. The application concatenates untrusted user input into a shell command without proper escaping, satisfying the conditions for [CWE-78]. Authentication is required, but any account with administrative access to the exposed function can trigger the injection.

Attack Vector

The attack vector is adjacent network, meaning the attacker must reach the NVR from the same logical network segment (for example, the LAN or a VLAN routed to the device). Attackers first obtain valid credentials through phishing, credential reuse, default credentials, or a companion vulnerability. They then submit a malicious payload to the vulnerable endpoint, embedding shell separators such as ;, &&, or backticks to append commands. The injected commands execute with the privileges of the web service process on the NVR.

No verified public proof-of-concept code is available for CVE-2025-7723 at the time of writing. Refer to the TP-Link VIGI NVR1104H Firmware and TP-Link VIGI NVR2016H Firmware pages for technical release details.

Detection Methods for CVE-2025-7723

Indicators of Compromise

Unexpected outbound connections from NVR management IP addresses to attacker-controlled hosts.
New or modified processes on the NVR that spawn shell interpreters such as /bin/sh from the web service.
Configuration or account changes on the NVR appearing outside normal maintenance windows.
Anomalous authenticated sessions to the NVR web interface originating from unusual internal endpoints.

Detection Strategies

Inspect NVR web server logs for requests containing shell metacharacters such as ;, |, &&, or $() in parameter values.
Correlate authenticated administrative logins with subsequent outbound network activity from the NVR.
Compare firmware version banners against fixed builds 1.1.5 Build 250518 and 1.3.1 Build 250407 to identify unpatched devices.

Monitoring Recommendations

Forward NVR syslog and authentication events to a centralized logging platform for retention and analytics.
Segment surveillance VLANs and monitor east-west traffic to detect lateral movement originating from NVR appliances.
Alert on new SSH, Telnet, or reverse-shell connections initiated from NVR management interfaces.

How to Mitigate CVE-2025-7723

Immediate Actions Required

Upgrade VIGI NVR1104H-4P V1 to firmware 1.1.5 Build 250518 or later.
Upgrade VIGI NVR2016H-16MP V2 to firmware 1.3.1 Build 250407 or later.
Rotate all administrative credentials on affected NVR devices after patching.
Restrict management interface access to a dedicated administrative VLAN.

Patch Information

TP-Link has released firmware updates that remediate the command injection flaw. Download the latest firmware from the TP-Link VIGI NVR1104H Firmware and TP-Link VIGI NVR2016H Firmware support pages. Follow the vendor's upgrade instructions in the TP-Link FAQ Document to preserve device configuration during the update.

Workarounds

Disable remote management on the NVR until firmware updates are applied.
Enforce network access control lists that permit only trusted administrative hosts to reach the NVR web interface.
Require multi-factor authentication on jump hosts used to access surveillance infrastructure.
Remove or disable unused administrative accounts on affected NVR devices.

bash

# Configuration example: restrict NVR management access with an upstream ACL
# Example iptables rule permitting only a trusted admin subnet to reach the NVR web UI
iptables -A FORWARD -s 10.10.50.0/24 -d 10.20.30.40 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d 10.20.30.40 -p tcp --dport 443 -j DROP