An unauthenticated attacker can manipulate the ip, port, and queryb64str parameters of the /cgi-bin/nobody/Search.cgi endpoint to cause the affected AVTECH DVR device to issue arbitrary HTTP requests to internal or external systems. Because the endpoint is publicly exposed, the attacker can retrieve sensitive data from internal services or interact with external resources, leading to potential data leakage and unauthorized configuration adjustments. The weakness is a server‑side request forgery (CWE‑918) combined with a potential data‑exposure flaw (CWE‑200).

AVTECH DVR devices running the firmware versions identified in the advisory are affected. The provided CNA list does not specify exact firmware revisions, but any device that exposes the /cgi-bin/nobody/Search.cgi endpoint without authentication is vulnerable. Administrators should review firmware documentation for their installed version and verify whether the Search.cgi endpoint remains exposed.

The CVSS score of 6.9 indicates moderate severity, while the EPSS score of < 1% shows that exploitation is currently unlikely and the vulnerability is not listed in the CISA KEV catalog. If an attacker can reach the exposed endpoint—typically via the device’s HTTP interface over a local or scoped network—they can initiate outbound requests from the DVR to arbitrary hosts, potentially exfiltrating data or attacking internal services. The likely attack vector is a remote or local network request to the vulnerable endpoint, inferred from the need to reach /cgi-bin/nobody/Search.cgi.