A cross‑site request forgery vulnerability exists in the web interface of AVTECH IP camera, DVR, and NVR devices. Attacks exploit the website’s lack of anti‑CSRF protection. An attacker, by executing a malicious request in the context of a logged‑in user’s browser session, can change device parameters or settings without the user’s interaction. The weakness is a classic verb‑preserving, state‑changing request without a valid token, classified as CWE‑352. The compromised configuration can affect network connectivity, image capture, or other core functions, providing an attacker with significant operational impact.

The vulnerability impacts AVTECH DVR devices, AVTECH IP cameras, and AVTECH NVR devices. No specific firmware versions are listed in the advisory, so any device running the affected web interface is potentially susceptible.

The CVSS score is 5.1, indicating a moderate severity. The EPSS score is below 1 %, suggesting a very low exploitation probability under current threat intelligence. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a web‑based CSRF using an authenticated user’s browser session, which requires remote access to the device’s web UI and an active session from a compromised or malicious site.