An OS command injection flaw exists in the custom HTTP service "Cross Web Server" of TVT white‑label CCTV‑DVR units. The service accepts a URI path parameter /language/[lang]/index.html and feeds the [lang] value unsafely into a tar extraction command without proper validation or escaping. An unauthenticated attacker can supply shell metacharacters in [lang] to inject arbitrary commands, resulting in root‑privileged execution. The vulnerability is a classic command injection (CWE‑78) and provides complete control over the embedded Linux OS once reached.

All Shenzhen TVT CCTV‑DVR models that ship with the Cross Web Server listening on TCP ports 81 and 82 are impacted. This includes the TD‑2004, TD‑2008, TD‑2104, TD‑2108, TD‑2116, TD‑2704, TD‑2708, TD‑2716, TD‑2732 and TD‑2932 series, with both hardware and firmware variations. Because the advisory references the service rather than specific firmware revisions, any device running the vulnerable service regardless of firmware version is at risk.

The CVSS vector assigns a base score of 10, indicating exploitation yields full confidentiality, integrity and availability compromise. The EPSS score of 19 % indicates that, at the time of analysis, there is a relatively high probability that this flaw will be exploited in the wild. The vulnerability is not listed in the CISA KEV, but the evidence of exploitation reported on 6 Feb 2025 confirms active use. Attackers can reach the target from any host that can contact ports 81 or 82, without authentication, and inject commands via crafted HTTP requests—a minimal effort remote attack. Therefore, the risk of premature compromise is high.