InfoSecBulletin Cybersecurity for mankind
TP-Link has warned users about two serious command injection vulnerabilities in its VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2 devices. Identified as CVE-2025-7723 and CVE-2025-7724, these flaws have CVSS scores of 8.5 and 8.7 and could let attackers run arbitrary commands on the system.
“Attackers may execute arbitrary commands on the device’s underlying operating system,” TP-Link stated in its advisory.
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
These vulnerabilities affect the following firmware versions:
VIGI NVR1104H-4P V1: firmware versions prior to 1.1.5 Build 250518
VIGI NVR2016H-16MP V2: firmware versions prior to 1.3.1 Build 250407
CVE-2025-7723 is a command injection vulnerability that occurs after authentication. Attackers with valid credentials can exploit this flaw to execute harmful commands on the OS. Although authentication is needed, it still presents a significant threat in situations where credentials may be weak, shared, or compromised.
CVE-2025-7724 is highly concerning as it lets attackers access the system without any credentials. If exploited, it could provide command-line access to the OS, risking full device control and network infiltration.
TP-Link has launched updated firmware for the affected NVR models. Users should upgrade to these builds:
VIGI NVR1104H-4P V1: 1.1.5 Build 250518
VIGI NVR2016H-16MP V2: 1.3.1 Build 250407
