InfoSecBulletin Cybersecurity for mankind
TP-Link has warned users about two serious command injection vulnerabilities in its VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2 devices. Identified as CVE-2025-7723 and CVE-2025-7724, these flaws have CVSS scores of 8.5 and 8.7 and could let attackers run arbitrary commands on the system.
“Attackers may execute arbitrary commands on the device’s underlying operating system,” TP-Link stated in its advisory.
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
FortiSandbox, FortiOS, FortiProxy ZTNA flaws unveil, while Fortigate firewall actively exploited
Microsoft Patch Tuesday September 2026 Fixed 973 Flaws Fixed, 2 Zero-Days
A single call: ShinyHunters Gained Access to 6 Million Customers’ Records
These vulnerabilities affect the following firmware versions:
VIGI NVR1104H-4P V1: firmware versions prior to 1.1.5 Build 250518
VIGI NVR2016H-16MP V2: firmware versions prior to 1.3.1 Build 250407
CVE-2025-7723 is a command injection vulnerability that occurs after authentication. Attackers with valid credentials can exploit this flaw to execute harmful commands on the OS. Although authentication is needed, it still presents a significant threat in situations where credentials may be weak, shared, or compromised.
CVE-2025-7724 is highly concerning as it lets attackers access the system without any credentials. If exploited, it could provide command-line access to the OS, risking full device control and network infiltration.
TP-Link has launched updated firmware for the affected NVR models. Users should upgrade to these builds:
VIGI NVR1104H-4P V1: 1.1.5 Build 250518
VIGI NVR2016H-16MP V2: 1.3.1 Build 250407
