What’s Vulnerable › Vulnerabilities
CVE-2026-34005
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.6% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-03-29 · updated 2026-06-17
- Weakness: CWE-78
Description
In Sofia on Xiongmai DVR/NVR (AHB7008T-MH-V2 and NBD7024H-P) 4.03.R11 devices, root OS command injection can occur via shell metacharacters in the HostName value via an authenticated DVRIP protocol (TCP port 34567) request to the NetWork.NetCommon configuration handler, because system() is used.
Affected products
- Xiongmai DVR/NVR devices: 4.03.R11
References
Get alerted when CVE-2026-34005 or the next vulnerability affects your stack