CVE-2025-34036 is a critical (CVSS 9.8) OS command injection in white-labeled DVRs made by TVT. The Cross Web Server on TCP ports 81 and 82 mishandles the language path, so an unauthenticated attacker can run commands as root. The record cites exploitation evidence. No fix is confirmed.
What's affected
The record lists several TVT DVR models, including TD-2004TS-CL, TD-2008TS-CL and TD-2104TS-CL variants and their firmware. The VulnCheck advisory refers to white-labeled DVRs sold under many brand names and gives no list of firmware versions or fixes.
Because the same hardware is rebadged, the brand on the box may not tell you whether you are affected. Look for a web service called Cross Web Server on ports 81 and 82.
How to check if you're exposed
Identify DVRs and network video recorders on your network. Check the model and firmware in the device menu, and look for the vendor name TVT or for an OEM label.
Check whether ports 81 and 82 answer on the device. An internal scan from a trusted machine, or your network monitoring, will show it. Then confirm that those ports are not forwarded from your router or firewall to the internet. Many DVRs are exposed by a forwarding rule set up years ago for remote viewing.
This is a shipped product or appliance, not a package you import, so a manifest scan will not list it. Use your asset inventory, procurement records or network discovery to find every instance, then compare the version you find against the fixed version in the vendor notes. Safeguard's free in-browser dependency scan and the Gold directory are useful for the open source parts of your estate, and you can look up this CVE in Gold to see how it is tracked.
What to do now
- List all DVRs and cameras and note the model, firmware and ports in use.
- Remove port forwarding for ports 81 and 82 and any other DVR port.
- Put recorders on a separate network segment with no route to the internet or to business systems.
- Use a VPN for remote viewing instead of exposing the device.
- Ask the vendor or your installer for fixed firmware, and replace devices that no longer receive updates.
- Check the recorder for unknown accounts or changed settings, and review traffic for outbound connections you do not recognise.
Why it matters
The weakness is CWE-78, OS command injection. The advisory explains that the request path for the language feature is used in a tar extraction command without escaping, so characters in the path can alter the command. The web service runs with root rights, which gives full control of the recorder.
The record states that the Shadowserver Foundation observed exploitation evidence on 6 February 2025, and the VulnCheck advisory lists it in its own KEV list. The CISA KEV flag in the record is false. The advisory also links a much older public write up from 2016, which tells you this class of weakness in DVR firmware has been known for years and is rarely fixed in the field.
Quick check
What ports does the vulnerable service use?
TCP ports 81 and 82, according to the record.
Is there a fixed firmware?
None is confirmed in the sources reviewed. Contact the vendor or installer and isolate the device meanwhile.
Sources
Last reviewed: 18 October 2026.
