AVTECH IP camera, DVR, and NVR devices expose a streamd web server that performs a simple string search with strstr() for the substring ".cab". Any HTTP request whose URL contains the ".cab" string causes the server to skip authentication checks and grant direct access to protected endpoints. This flaw allows an attacker to retrieve or manipulate sensitive device data without valid credentials, potentially leading to unauthorized monitoring, configuration changes, or data exfiltration.

The affected products are AVTECH IP cameras, DVRs, and NVR devices. The CVE does not list specific firmware or software versions; the flaw exists in the streamd web server component of the devices as described.

The Vulnerability has a CVSS score of 6.9, indicating moderate severity. The EPSS score is reported as <1%, implying a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, and the publicly available exploit-db reference suggests that an exploit has been demonstrated. The likely attack vector is a network‑based URL manipulation targeting the device’s web interface. Due to the absence of a mandatory authentication bypass, the flaw does not provide remote code execution by itself, but it exposes significant internal endpoints, increasing the potential impact if combined with other weaknesses.