CVE-2025-34036

An OS command injection vulnerability exists in white-labeled DVRs manufactured by TVT, affecting a custom HTTP service called "Cross Web Server" that listens on TCP ports 81 and 82. The web interface fails to sanitize input in the URI path passed to the language extraction functionality. When the server processes a request to /language/[lang]/index.html, it uses the [lang] input unsafely in a tar extraction command without proper escaping. This allows an unauthenticated remote attacker to inject shell commands and achieve arbitrary command execution as root. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-06 UTC. It has a CVSS v3.1 base score of 9.8 (CRITICAL).

CVE-2025-34036 has a CVSS v3.1 score of 9.8 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately.

CVE-2025-34036 affects products from tvt, specifically: td-2004ts-cl, td-2004ts-cl-c, td-2004ts-cl-c_firmware, td-2004ts-cl_firmware, td-2008ts-cl, td-2008ts-cl_firmware, td-2104ts-cl, td-2104ts-cl-a, td-2104ts-cl-a_firmware, td-2104ts-cl_firmware, td-2104ts-hc, td-2104ts-hc_firmware, td-2104ts-hp, td-2104ts-hp_firmware, td-2108ts-cl, td-2108ts-cl-a, td-2108ts-cl-a_firmware, td-2108ts-cl_firmware, td-2108ts-hc, td-2108ts-hc_firmware, td-2108ts-hp, td-2108ts-hp_firmware, td-2116te-hp, td-2116te-hp_firmware, td-2116ts-cl, td-2116ts-cl_firmware, td-2116ts-hc, td-2116ts-hc_firmware, td-2704ts-hc, td-2704ts-hc_firmware, td-2704ts-hp, td-2704ts-hp_firmware, td-2708te-hk, td-2708te-hk_firmware, td-2708te-hp, td-2708te-hp_firmware, td-2708ts-hc, td-2708ts-hc_firmware, td-2708ts-hp, td-2708ts-hp_firmware, td-2716tc-hc, td-2716tc-hc_firmware, td-2716tc-hp, td-2716tc-hp_firmware, td-2716td-hc, td-2716td-hc_firmware, td-2716te-hc, td-2716te-hc-a, td-2716te-hc-a_firmware, td-2716te-hc_firmware, td-2716te-hp, td-2716te-hp-a, td-2716te-hp-a_firmware, td-2716te-hp_firmware, td-2732tc-hc, td-2732tc-hc_firmware, td-2732td-hc, td-2732td-hc_firmware, td-2932td-hp, td-2932td-hp_firmware. Check the affected products table above for specific version ranges.

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.