TB-eye NVR/AHD DVR OS Command Injection and Buffer Overflow Vulnerabilities (CVE-2025-36529/CVE-2025-41418)

Key Information Vulnerability Identifier JVN ID: JVNVD#93396297 Affected Products Multiple TB-eye network video recorders and AHD recorders, including but not limited to: - XRN-410SN/TE (Ver2.47b_220119153805 and earlier) - XRN-810SN/TE (Ver2.47b_220119153805 and earlier) - XRN-1610SN/TE (Ver2.47b_210516234524 and earlier) - PRN-401IN/TE (Ver2.51jp_231200001715 and earlier) - HRX-423FN/TE (Ver3.05.62 and earlier) - HRX-1621/TE (Ver3.05.62 and earlier) - HRX-435FN/TE (Ver5.31.72 and earlier) - HRX-835F/TE (Ver5.31.72 and earlier) - HRX-1635F/TE (Ver5.31.72 and earlier) - HRX-425SF/TE (Ver5.31.32 and earlier) - HRX-426S (Ver5.33.12 and earlier) - HRX-820S/TE (Ver5.34.12 and earlier) - HRX-1620S/TE (Ver5.34.12 and earlier) - HRX-3210R/TE (Ver5.34.12 and earlier) - HRX-6410R/TE (Ver5.34.12 and earlier) - HRX-6410DR/TE (Ver5.34.12 and earlier) Vulnerability Description OS Command Injection (CWE-78) - CVSS v3.0 Base Score: 8.6 - CVSS v3.1 Base Score: 7.2 - CVE ID: CVE-2025-36529 Classic Buffer Overflow (CWE-120) - CVSS v3.0 Base Score: 6.9 - CVSS v3.1 Base Score: 5.3 - CVE ID: CVE-2025-41418 Impact Attackers can execute arbitrary OS commands after logging into the device (CVE-2025-36529) Maliciously crafted requests can cause the CGI process to terminate abnormally (CVE-2025-41418) Solution Firmware Update: Update to the latest version as provided by the vendor. Workaround: Users should change the administrator password to a non-guessable password. Vendor Status TB-eye Ltd. has issued an important notice (in Japanese) References JPCERT/CC Addendum JPCERT/CC Vulnerability Analysis Acknowledgments Chuya Hayakawa and Ryo Kamino reported these vulnerabilities to JPCERT/CC

Goal Reached Thanks to every supporter — we hit 100%!

TB-eye NVR/AHD DVR OS Command Injection and Buffer Overflow Vulnerabilities (CVE-2025-36529/CVE-2025-41418)