InfoSecBulletin Cybersecurity for mankind
TP-Link has warned users about two serious command injection vulnerabilities in its VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2 devices. Identified as CVE-2025-7723 and CVE-2025-7724, these flaws have CVSS scores of 8.5 and 8.7 and could let attackers run arbitrary commands on the system.
“Attackers may execute arbitrary commands on the device’s underlying operating system,” TP-Link stated in its advisory.
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
These vulnerabilities affect the following firmware versions:
VIGI NVR1104H-4P V1: firmware versions prior to 1.1.5 Build 250518
VIGI NVR2016H-16MP V2: firmware versions prior to 1.3.1 Build 250407
CVE-2025-7723 is a command injection vulnerability that occurs after authentication. Attackers with valid credentials can exploit this flaw to execute harmful commands on the OS. Although authentication is needed, it still presents a significant threat in situations where credentials may be weak, shared, or compromised.
CVE-2025-7724 is highly concerning as it lets attackers access the system without any credentials. If exploited, it could provide command-line access to the OS, risking full device control and network infiltration.
TP-Link has launched updated firmware for the affected NVR models. Users should upgrade to these builds:
VIGI NVR1104H-4P V1: 1.1.5 Build 250518
VIGI NVR2016H-16MP V2: 1.3.1 Build 250407
