CVE-2018-25126 TVT NVMS-9000 Hard-coded API Credentials & Command Injection
Unauthenticated attackers can use hardcoded credentials to inject shell commands into TVT NVMS-9000 devices, achieving root-level remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-25126?
CVE-2018-25126 is a critical command injection vulnerability in Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000, published on 24 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 firmware (used by many white-labeled DVR/NVR/IPC products) contains hardcoded API credentials and an OS command injection flaw in its configuration services. The web/API interface accepts HTTP/XML requests authenticated with a fixed vendor credential string and passes user-controlled fields into shell execution contexts without proper argument sanitization. An unauthenticated remote attacker can leverage the hard-coded credential to access endpoints such as /editBlackAndWhiteList and inject shell metacharacters inside XML parameters, resulting in arbitrary command execution as root. The same vulnerable backend is also reachable in some models through a proprietary TCP service on port 4567 that accepts a magic GUID preface and base64-encoded XML, enabling the same command injection sink. Firmware releases from mid-February 2018 and later are reported to have addressed this issue. Exploitation evidence was observed by the Shadowserver Foundation on 2025-01-28 UTC.
Which versions are affected by CVE-2018-25126?
How do I fix CVE-2018-25126?
No fix has been published for CVE-2018-25126 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2018-25126 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-25126 exists.
Sources
Also known as GHSA-54fc-5f6v-pcx6.