CVE-2025-10265

Certain models of NVR developed by Digiever has an OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the device.

Score

CVSS 3.1 8.8 High

Status

Deferred - twcert@cert.org.tw

Published

2025-09-12

Last modified

2025-09-29

Weaknesses

CWE-78

Affected products

• Ds-1200 (Digiever)
• Ds-16x00-rm Pro (Digiever)
• Ds-16x00-rm Uhd (Digiever)
• Ds-2100 Pro (Digiever)
• Ds-2100 Uhd (Digiever)
• Ds-2200 Uhd (Digiever)
• Ds-4100-rm (Digiever)
• Ds-4200-rm Pro (Digiever)
• Ds-4200-rm Uhd (Digiever)
• Ds-4200 Pro (Digiever)
• Ds-4200 Uhd (Digiever)
• Ds-8x00-rm Pro (Digiever)
• Ds-8x00-rm Uhd (Digiever)
• Ds-8x00-srm Pro (Digiever)

References

• https://www.twcert.org.tw/en/cp-139-10376-a057c-2.html
• https://www.twcert.org.tw/tw/cp-132-10375-19f1e-1.html