What’s Vulnerable › Vulnerabilities

CVE-2018-25126: TVT NVMS-9000 Hard-coded API Credentials & Command Injection

• Severity: critical (CVSS 9.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-11-24 · updated 2026-06-17
• Weakness: CWE-78

Description

Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 firmware (used by many white-labeled DVR/NVR/IPC products) contains hardcoded API credentials and an OS command injection flaw in its configuration services. The web/API interface accepts HTTP/XML requests authenticated with a fixed vendor credential string and passes user-controlled fields into shell execution contexts without proper argument sanitization. An unauthenticated remote attacker can leverage the hard-coded credential to access endpoints such as /editBlackAndWhiteList and inject shell metacharacters inside XML parameters, resulting in arbitrary command execution as root. The same vulnerable backend is also reachable in some models through a proprietary TCP service on port 4567 that accepts a magic GUID preface and base64-encoded XML, enabling the same command injection sink. Firmware releases from mid-February 2018 and later are reported to have addressed this issue. Exploitation evidence was observed by the Shadowserver Foundation on 2025-01-28 UTC.

Affected products

• Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000: before mid-February firmware builds — fixed in mid-February firmware builds

How to fix

Upgrade to a fixed version: Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 mid-February firmware builds. Check the vendor advisory for mitigations.

References

• https://blogs.juniper.net/en-us/threat-research/iot-botnet-exploiting-tvt-shenzhen-dvrs-still-lingers
• https://github.com/mcw0/PoC/blob/master/TVT_and_OEM_IPC_NVR_DVR_RCE_Backdoor_and_Information_Disclosure.txt
• https://qkl.seebug.org/vuldb/ssvid-97217
• https://web.archive.org/web/20180614014914/http://en.tvt.net.cn:80/news/227.html
• https://www.vulncheck.com/advisories/tvt-nvms9000-hardcoded-api-credentials-and-command-injection

Get alerted when CVE-2018-25126 or the next vulnerability affects your stack