CVE-2018-25126

The record

Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 firmware (used by many white-labeled DVR/NVR/IPC products) contains hardcoded API credentials and an OS command injection flaw in its configuration services. The web/API interface accepts HTTP/XML requests authenticated with a fixed vendor credential string and passes user-controlled fields into shell execution contexts without proper argument sanitization. An unauthenticated remote attacker can leverage the hard-coded credential to access endpoints such as /editBlackAndWhiteList and inject shell metacharacters inside XML parameters, resulting in arbitrary command execution as root. The same vulnerable backend is also reachable in some models through a proprietary TCP service on port 4567 that accepts a magic GUID preface and base64-encoded XML, enabling the same command injection sink. Firmware releases from mid-February 2018 and later are reported to have addressed this issue. Exploitation evidence was observed by the Shadowserver Foundation on 2025-01-28 UTC.

Affected packages

Related vulnerabilities

• CVE-2026-96376 Improper Neutralization of Special Elements used in an OS Command ("OS Command… CWE-78
• CVE-2026-113732 virtualenv is a tool for creating isolated virtual python environments. CWE-78
• CVE-2026-113776 virtualenv is a tool for creating isolated virtual python environments. CWE-78
• CVE-2026-113726 virtualenv is a tool for creating isolated virtual python environments. CWE-78
• CVE-2026-113725 virtualenv is a tool for creating isolated virtual python environments. CWE-78
• CVE-2026-113722 virtualenv is a tool for creating isolated virtual python environments. CWE-78
• CVE-2026-112943 launch-editor allows users to open files with line numbers in editor from Node.js. CWE-78
• CVE-2026-112900 Pillow is a Python imaging library. CWE-78