What’s Vulnerable › Vulnerabilities

CVE-2024-14007: TVT NVMS-9000 < 1.3.4 Unauthenticated Administrative Queries & Information Disclosure

• Severity: high (CVSS 8.7 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-11-24 · updated 2026-09-26
• Weakness: CWE-306

Description

Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 firmware (used by many white-labeled DVR/NVR/IPC products) versions prior to 1.3.4 contain an authentication bypass in the NVMS-9000 control protocol. By sending a single crafted TCP payload to an exposed NVMS-9000 control port, an unauthenticated remote attacker can invoke privileged administrative query commands without valid credentials. Successful exploitation discloses sensitive information including administrator usernames and passwords in cleartext, network and service configuration, and other device details via commands such as queryBasicCfg, queryUserList, queryEmailCfg, queryPPPoECfg, and queryFTPCfg.

Affected products

• Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000: before 1.3.4 — fixed in 1.3.4

How to fix

Upgrade to a fixed version: Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 1.3.4. Check the vendor advisory for mitigations.

References

• https://ssd-disclosure.com/ssd-advisory-nvms9000-information-disclosure/
• https://undercodetesting.com/eleven11-botnet-mirai-variant-targeting-nvms-9000-devices/
• https://www.greynoise.io/blog/surge-exploitation-attempts-tvt-dvrs
• https://www.vulncheck.com/advisories/tvt-nvms9000-unauthenticated-admin-queries-and-information-disclosure

Get alerted when CVE-2024-14007 or the next vulnerability affects your stack