Vulnerability · Published Nov 24, 2025 · Assigned by VulnCheck
CVE-2024-14007TVT NVMS-9000 < 1.3.4 Unauthenticated Administrative Queries & Information Disclosure
High 8.7
In plain English
A high-severity missing authentication in NVMS-9000 from Shenzhen TVT Digital Technology Co., Ltd.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).
Official description
Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 firmware (used by many white-labeled DVR/NVR/IPC products) versions prior to 1.3.4 contain an authentication bypass in the NVMS-9000 control protocol. By sending a single crafted TCP payload to an exposed NVMS-9000 control port, an unauthenticated remote attacker can invoke privileged administrative query commands without valid credentials. Successful exploitation discloses sensitive information including administrator usernames and passwords in cleartext, network and service configuration, and other device details via commands such as queryBasicCfg, queryUserList, queryEmailCfg, queryPPPoECfg, and queryFTPCfg.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Shenzhen TVT Digital Technology Co., Ltd. | NVMS-9000 | 0 – before 1.3.4 |
Weakness: CWE-306 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
References
- https://ssd-disclosure.com/ssd-advisory-nvms9000-information-disclosure/ technical-description, exploit
- https://www.greynoise.io/blog/surge-exploitation-attempts-tvt-dvrs related
- https://undercodetesting.com/eleven11-botnet-mirai-variant-targeting-nvms-9000-devices/ related
- https://www.vulncheck.com/advisories/tvt-nvms9000-unauthenticated-admin-queries-and-information-disclosure third-party-advisory