An authentication bypass flaw exists in the streamd web server of AVTECH IP camera, DVR, and NVR devices. The flaw is caused by the strstr() function that permits any HTTP request containing the path fragment "/nobody" to be processed without requiring login credentials, effectively bypassing the device’s authentication mechanism. While the description does not explicitly state what functions become available after bypass, it is inferred that an attacker could access any privileged functionality normally protected by authentication, such as viewing live streams or changing configuration settings.

The affected equipment is the AVTECH IP camera, DVR, and NVR product line. No specific firmware revisions or model numbers were cited; the vulnerability is reported to affect the base streamd web server present in all AVTECH devices that host this component.

The CVSS score of 6.9 indicates a moderate severity level. The EPSS score is reported to be less than 1%, suggesting that exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. The most probable attack vector is an unauthenticated HTTP request directed at the device’s web interface, containing the substring "/nobody" in the URL path. If the device is reachable from an untrusted network or the internet, an attacker could exploit this path without any credentials or additional privileges.