An OS command injection flaw exists in the PwdGrp.cgi endpoint of AVTECH IP camera, DVR, and NVR devices. The CGI accepts authenticated user input through the pwd and grp fields and concatenates it directly into system shell commands without any sanitization. This missing input validation allows an authenticated user to run arbitrary shell commands as if they were the root user. The flaw is a classic example of CWE‑20 (Improper Input Validation) and CWE‑78 (OS Command Injection).

AVTECH IP camera, DVR, and NVR devices are affected, but specific firmware or model versions are not disclosed in the advisory. The vulnerability impacts all devices that expose the PwdGrp.cgi interface to authenticated users. Since the advisory references multiple device types, it is reasonable to assume that all AVTECH surveillance and DVR/NVR platforms that use this CGI are at risk unless already upgraded.

The vulnerability carries a CVSS score of 9.4, indicating a high severity and a likely remote exploitation. The EPSS score is 2 %, indicating a low probability of exploitation in the wild. The exploit requires authentication with privileges that allow access to the user/group management interface, so it is primarily an internal‑network or privileged‑account attack vector. It is not currently listed in the CISA KEV catalog, but once patched it should be reviewed. The attacker could achieve full control over the device, compromising confidentiality, integrity, and availability.