InfoSecBulletin Cybersecurity for mankind
TP-Link has warned users about two serious command injection vulnerabilities in its VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2 devices. Identified as CVE-2025-7723 and CVE-2025-7724, these flaws have CVSS scores of 8.5 and 8.7 and could let attackers run arbitrary commands on the system.
“Attackers may execute arbitrary commands on the device’s underlying operating system,” TP-Link stated in its advisory.
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
Cl0p Ransomware Listed 40+ Victims of PTC Windchill Campaign
Oracle Issues 943 Security Patches, Including Critical WebLogic Flaw
500+ critical infrastructure hit by Medusa ransomware
Critical WordPress Plugin Flaw Exposes 600,000 Sites to Attacks
These vulnerabilities affect the following firmware versions:
VIGI NVR1104H-4P V1: firmware versions prior to 1.1.5 Build 250518
VIGI NVR2016H-16MP V2: firmware versions prior to 1.3.1 Build 250407
CVE-2025-7723 is a command injection vulnerability that occurs after authentication. Attackers with valid credentials can exploit this flaw to execute harmful commands on the OS. Although authentication is needed, it still presents a significant threat in situations where credentials may be weak, shared, or compromised.
CVE-2025-7724 is highly concerning as it lets attackers access the system without any credentials. If exploited, it could provide command-line access to the OS, risking full device control and network infiltration.
TP-Link has launched updated firmware for the affected NVR models. Users should upgrade to these builds:
VIGI NVR1104H-4P V1: 1.1.5 Build 250518
VIGI NVR2016H-16MP V2: 1.3.1 Build 250407
