Loading vulnerability details…
CVSS v3.1
N/A
CVSS v4.0
6.9
EPSS
0.54%
Published
Jul 1, 2025
Modified
Apr 14, 2026
Public PoC / Exploit (1)
All weaponized →Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.
Description
An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr() function allows unauthenticated access to any request containing "/nobody" in the URL, bypassing login controls.
Weaknesses (CWE)
References (5)