AVTECH Security Corporation’s DGM3103SCT web management console contains an OS command injection flaw. An attacker who is able to log into the console can supply crafted input that is executed by the underlying operating system with root privileges, effectively allowing the attacker to run any command on the device.

The vulnerable device is AVTECH Security Corporation’s DGM3103SCT IP camera, covering all firmware releases that expose the web management console. No specific version information is provided, so any device that implements the console is potentially affected.

The CVSS score of 8.6 indicates a high‑severity vulnerability. EPSS is not available, and the issue is not listed in CISA’s KEV catalog, yet the impact remains severe because authenticated users can trigger the injection. The attack vector is inferred to be through the web interface after a valid login, so a local or remote attacker who can reach the console’s network port and authenticate can exploit the flaw. The lack of a public patch suggests a high risk of exploitation if no mitigation is applied promptly.