CVE-2026-34005

Root OS Command Injection via HostName on Xiongmai DVR/NVR

View on CVE.org
Published Mar 29, 2026 CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Not listed
Description
In Sofia on Xiongmai DVR/NVR (AHB7008T-MH-V2 and NBD7024H-P) 4.03.R11 devices, root OS command injection can occur via shell metacharacters in the HostName value via an authenticated DVRIP protocol (TCP port 34567) request to the NetWork.NetCommon configuration handler, because system() is used.

Analysis

AI-generated

Technical impact

The vulnerability allows an attacker who can authenticate to the DVRIP protocol to inject shell metacharacters into the HostName configuration field, causing the device's firmware to invoke the system() function with that string. This results in OS command execution with root privileges, enabling full control over the device and compromising confidentiality, integrity, and availability.

Affected Systems

The affected devices are Xiongmai DVR/NVR models AHB7008T-MH-V2 and NBD7024H-P running the Sofia 4.03.R11 firmware. No other versions or models are listed as impacted.

Risk and Exploitability

The CVSS score of 8.8 reflects high severity. The EPSS score of 2% indicates a relatively low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker must first authenticate to the DVRIP protocol on TCP port 34567. Once authenticated, a crafted HostName value can trigger the vulnerable system() call, giving the attacker unrestricted root access to the underlying operating system.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest firmware update released by Xiongmai that removes the vulnerable system() usage.
  • If a patch is unavailable, limit access to TCP port 34567 by firewall rules to trusted networks and enforce multifactor authentication.
  • Change default credentials and enforce a strong password policy to reduce the likelihood of credential compromise.

Generated by OpenCVE AI on June 18, 2026 at 09:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Title Root OS Command Injection via HostName on Xiongmai DVR/NVR
Type Values Removed Values Added
Title Root OS Command Injection via HostName Field in Xiongmai DVR/NVR
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Xiongmai
Xiongmai dvr/nvr Devices
Vendors & Products Xiongmai
Xiongmai dvr/nvr Devices
Type Values Removed Values Added
Title Root OS Command Injection via HostName Field in Xiongmai DVR/NVR
Type Values Removed Values Added
Description In Sofia on Xiongmai DVR/NVR (AHB7008T-MH-V2 and NBD7024H-P) 4.03.R11 devices, root OS command injection can occur via shell metacharacters in the HostName value via an authenticated DVRIP protocol (TCP port 34567) request to the NetWork.NetCommon configuration handler, because system() is used.
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}
Earlier changes (1)
Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Mar 30, 2026, 2:19 PM
Reserved
Mar 25, 2026, 5:22 AM

View source JSON

Updated
Mar 30, 2026, 2:19 PM

JSON

Status
Deferred
Published
Mar 29, 2026, 5:16 PM
Modified
Jun 17, 2026, 10:38 AM

View source JSON

No data.

Updated
Jun 18, 2026, 10:00 AM

JSON