An authenticated user can call the DoShellCmd operation through the adcommand.cgi endpoint on AVTECH DVR, NVR, and IP camera devices. The strCmd parameter is passed unfiltered to the system shell, enabling arbitrary OS command execution with the privileges of the ActionD daemon. The result is full compromise of the device as root, allowing an attacker to modify, delete, or exfiltrate data, install persistent malware, or use the device in a larger attack chain. The weakness reflects improper input validation and unsafe command construction (CWE-20, CWE-78).

AVTECH IP camera, DVR, and NVR devices.

The CVSS score of 9.4 classifies this flaw as critical, indicating exploitation would give an attacker total control over the affected device. The EPSS score of 2% suggests that, while the vulnerability exists, it is currently seldom exploited in the wild. The vendor has not listed this issue in the CISA KEV catalog. Exploitation requires valid credentials, so the attack vector is typically internal or involves phishing to gain authenticated access. Once authenticated, an attacker can trigger any shell command, resulting in a full root compromise.