Shenzhen TVT Digital NVMS-9000 Web/API hard-coded credentials

Summaryinfo

A vulnerability, which was classified as critical, has been found in Shenzhen TVT Digital NVMS-9000. This issue affects some unknown processing of the component Web/API. The manipulation leads to hard-coded credentials. This vulnerability is referenced as CVE-2018-25126. Remote exploitation of the attack is possible. Furthermore, an exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in Shenzhen TVT Digital NVMS-9000 (affected version unknown). This issue affects an unknown functionality of the component Web/API. The manipulation with an unknown input leads to a hard-coded credentials vulnerability. Using CWE to declare the problem leads to CWE-798. The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 firmware (used by many white-labeled DVR/NVR/IPC products) contains hardcoded API credentials and an OS command injection flaw in its configuration services. The web/API interface accepts HTTP/XML requests authenticated with a fixed vendor credential string and passes user-controlled fields into shell execution contexts without proper argument sanitization. An unauthenticated remote attacker can leverage the hard-coded credential to access endpoints such as /editBlackAndWhiteList and inject shell metacharacters inside XML parameters, resulting in arbitrary command execution as root. The same vulnerable backend is also reachable in some models through a proprietary TCP service on port 4567 that accepts a magic GUID preface and base64-encoded XML, enabling the same command injection sink. Firmware releases from mid-February 2018 and later are reported to have addressed this issue. Exploitation evidence was observed by the Shadowserver Foundation on 2025-01-28 UTC.

The weakness was published by mcw0. The advisory is shared at web.archive.org. The identification of this vulnerability is CVE-2018-25126 since 11/24/2025. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are unknown but a public exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 11/25/2025). MITRE ATT&CK project uses the attack technique T1110.001 for this issue.

The exploit is available at blogs.juniper.net. It is declared as highly functional.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-199000). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Shenzhen TVT Digital

Name

• NVMS-9000

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion