CVE-2025-5113 Details

A vulnerability has been identified in the Diviotec professional series IP cameras, including models nbr222p, nbr222pv, nbr224p, nbr225p, nbr226p, nbf232p, nbf233p, ndr252p, and ndr255p. All versions of these cameras are affected. The vulnerability arises from arbitrary command injection in a CGI script called 'camctrl.cgi', which is executed by the 'apache' user. This script improperly sanitizes user input, allowing remote attackers to inject commands that are executed with elevated privileges. Additionally, the cameras use hardcoded passwords, which can be exploited to bypass authentication and access the vulnerable endpoint.

Affected cameras should be isolated from the Internet, default or weak passwords replaced, and a firmware update requested from Diviotec or Nexcomm. After applying the update, CGI scripts should be re-audited for proper input sanitization and unnecessary sudo privileges for the 'apache' user removed.