InfoSecBulletin Cybersecurity for mankind
TP-Link has warned users about two serious command injection vulnerabilities in its VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2 devices. Identified as CVE-2025-7723 and CVE-2025-7724, these flaws have CVSS scores of 8.5 and 8.7 and could let attackers run arbitrary commands on the system.
“Attackers may execute arbitrary commands on the device’s underlying operating system,” TP-Link stated in its advisory.
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
Cyber attack causes French bank Credit Mutuel Arkea €100 million missing
OpenAI AI Pipeline Discovers 948 Linux Kernel Privilege Escalation Flaws in 30 Hours
Bangladeshi Researcher Rasel Earns First Apple CVE Recognition for Model I/O Flaw
These vulnerabilities affect the following firmware versions:
VIGI NVR1104H-4P V1: firmware versions prior to 1.1.5 Build 250518
VIGI NVR2016H-16MP V2: firmware versions prior to 1.3.1 Build 250407
CVE-2025-7723 is a command injection vulnerability that occurs after authentication. Attackers with valid credentials can exploit this flaw to execute harmful commands on the OS. Although authentication is needed, it still presents a significant threat in situations where credentials may be weak, shared, or compromised.
CVE-2025-7724 is highly concerning as it lets attackers access the system without any credentials. If exploited, it could provide command-line access to the OS, risking full device control and network infiltration.
TP-Link has launched updated firmware for the affected NVR models. Users should upgrade to these builds:
VIGI NVR1104H-4P V1: 1.1.5 Build 250518
VIGI NVR2016H-16MP V2: 1.3.1 Build 250407
