CVE-2025-34042 Details
Description
An authenticated command injection vulnerability exists in the Beward N100 IP Camera firmware version M2.1.6.04C014 via the ServerName and TimeZone parameters in the servetest CGI page. An attacker with access to the web interface can inject arbitrary system commands into these parameters, which are unsafely embedded into backend system calls without proper input sanitization. Successful exploitation results in remote code execution with root privileges. Exploitation evidence was observed by the Shadowserver Foundation on 2024-12-02 UTC.
A command injection vulnerability allowing remote code execution has been identified in the Beward N100 IP Camera, specifically in the firmware version M2.1.6.04C014. This vulnerability arises from improper input validation in the servetest CGI page, where the ServerName and TimeZone parameters can be exploited to inject arbitrary system commands. The injected commands are executed with root privileges, compromising the device's security.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 26, 2025CISA-ADP
Assessed Dec 23, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cxsecurity.com/issue/WLB-2019020042 | [email protected] | ExploitTechnical Description |
| https://packetstorm.news/files/id/151531 | [email protected] | Exploit |
| https://s4e.io/tools/beward-n100-h264-vga-ip-camera-arbitrary-file-disclosure | [email protected] | Not Applicable |
| https://vulncheck.com/advisories/beward-n100-remote-command-execution | [email protected] | AdvisoryBroken Link |
| https://www.beward.net | [email protected] | Vendor |
| https://www.fortiguard.com/encyclopedia/ips/48618 | [email protected] | AdvisoryExploit |
| https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5512.php | [email protected] | AdvisoryBundleExploit |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Beward N100 H.264 VGA IP Camera | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Nov 20, 2025 | CVE Modified | [email protected] |
| Nov 17, 2025 | CVE Modified | [email protected] |
| Jun 26, 2025 | New CVE Received | [email protected] |