AVTECH IP cameras, DVRs, and NVRs have an improper certificate validation flaw caused by the use of the wget utility with the --no-check-certificate flag in scripts such as SyncCloudAccount.sh and SyncPermit.sh. This defect allows an attacker to perform a Man-in-the-Middle attack on all HTTPS traffic exchanged by the device, exposing sensitive configuration data, video streams, or other communications to eavesdropping and modification. The weakness is a classic example of CWE‑295, where certificates are not validated, potentially compromising confidentiality and integrity of communications.

The vulnerability impacts AVTECH DVR devices, IP cameras, and NVR devices that run the affected scripts. Specific affected firmware versions are not listed in the advisory, so all models that contain these scripts and have not been patched carry the risk.

The CVSS score of 8.3 indicates high severity. The EPSS score of < 1% suggests current exploitation probability is low, and the issue is not listed in the CISA KEV catalog, meaning no confirmed widespread attacks are reported. Based on the description, the most probable attack vector is an unauthenticated network adversary who can intercept or modify traffic to the device, leveraging the insecure certificate trust to inject traffic or spy on data.