CVE-2025-34036

An unauthenticated OS command injection vulnerability (CWE-78) exists in the 'Cross Web Server' custom HTTP service embedded in white-labeled DVRs manufactured by TVT, which listens on TCP ports 81 and 82. When the service handles a request for /language/[lang]/index.html, it passes the [lang] portion of the URI path into a tar extraction command without sanitization or escaping, allowing an attacker to append arbitrary shell commands to the request. Because the web service runs as root, successful injection results in arbitrary command execution with full root privileges on the device. Any TVT-manufactured white-label DVR running the affected Cross Web Server software — including the listed TD-series models, which are sold under many rebrand names — is affected when the service is reachable by an attacker. Exploitation in the wild was observed by the Shadowserver Foundation on 2025-02-06 UTC, and with public exploit code documented since 2016, a maximum CVSS 4.0 score of 10.0, and a 26.9% EPSS probability of exploitation within 30 days, defenders should assume active scanning and compromise attempts.

What to do: Inventory all TVT-based and white-label DVRs exposing the Cross Web Server on TCP ports 81/82, restrict access with firewall rules or VPN rather than direct internet port forwarding, and obtain patched firmware from your DVR brand/vendor (TVT OEM) as it becomes available, since no fixed version numbers are provided in the available data. Because exploitation yields root-level code execution, treat any device showing signs of compromise — requests to /language/[lang]/index.html paths, unexpected processes, or unexplained outbound connections since 2025-02-06 — as fully compromised and reflash or replace it. Continue monitoring vendor advisories and Shadowserver/CISA reporting for updated indicators of compromise and patch guidance.