{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2026-34005", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-03-25T05:22:12.479Z", "datePublished": "2026-03-29T17:02:15.445Z", "dateUpdated": "2026-03-30T14:19:23.210Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "modules": ["Sofia binary - hostname configuration handler"], "product": "DVR/NVR devices", "vendor": "Xiongmai", "versions": [{"status": "affected", "version": "4.03.R11", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "In Sofia on Xiongmai DVR/NVR (AHB7008T-MH-V2 and NBD7024H-P) 4.03.R11 devices, root OS command injection can occur via shell metacharacters in the HostName value via an authenticated DVRIP protocol (TCP port 34567) request to the NetWork.NetCommon configuration handler, because system() is used."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-29T17:09:28.999Z"}, "references": [{"url": "https://www.xiongmaitech.com"}, {"url": "https://uky007.github.io/CVE-2026-34005/"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-30T14:19:13.856503Z", "id": "CVE-2026-34005", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-30T14:19:23.210Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Xiongmai", "modules": ["Sofia binary - hostname configuration handler"], "product": "DVR/NVR devices", "versions": [{"status": "affected", "version": "4.03.R11", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://www.xiongmaitech.com"}, {"url": "https://uky007.github.io/CVE-2026-34005/"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "In Sofia on Xiongmai DVR/NVR (AHB7008T-MH-V2 and NBD7024H-P) 4.03.R11 devices, root OS command injection can occur via shell metacharacters in the HostName value via an authenticated DVRIP protocol (TCP port 34567) request to the NetWork.NetCommon configuration handler, because system() is used."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-29T17:09:28.999Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34005", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-30T14:19:13.856503Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-03-30T14:19:18.931Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-34005", "state": "PUBLISHED", "dateUpdated": "2026-03-29T17:09:28.999Z", "dateReserved": "2026-03-25T05:22:12.479Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-03-29T17:02:15.445Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "In Sofia on Xiongmai DVR/NVR (AHB7008T-MH-V2 and NBD7024H-P) 4.03.R11 devices, root OS command injection can occur via shell metacharacters in the HostName value via an authenticated DVRIP protocol (TCP port 34567) request to the NetWork.NetCommon configuration handler, because system() is used."}], "id": "CVE-2026-34005", "lastModified": "2026-03-30T13:26:07.647", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "[email protected]", "type": "Secondary"}]}, "published": "2026-03-29T17:16:44.257", "references": [{"source": "[email protected]", "url": "https://uky007.github.io/CVE-2026-34005/"}, {"source": "[email protected]", "url": "https://www.xiongmaitech.com"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "[email protected]", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.03.R11"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "DVR/NVR devices", "source": "cna", "vendor": "Xiongmai"}, "product": "dvr/nvr_devices", "vendor": "xiongmai"}], "analysis": {"en": {"generated_at": "2026-03-29T19:21:11.333274+00:00", "value": {"mitigation_remediation": ["Apply the latest firmware update released by Xiongmai that removes the vulnerable system() usage.", "If a patch is unavailable, limit access to TCP port 34567 by firewall rules to trusted networks and enforce multifactor authentication.", "Change default credentials and enforce a strong password policy to reduce the likelihood of credential compromise."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The affected devices are Xiongmai DVR/NVR models AHB7008T-MH-V2 and NBD7024H-P running the Sofia 4.03.R11 firmware. No other versions or models are listed as impacted.", "description_and_impact": "The vulnerability allows an attacker who can authenticate to the DVRIP protocol to inject shell metacharacters into the HostName configuration field, causing the device's firmware to invoke the system() function with that string. This results in OS command execution with root privileges, enabling full control over the device and compromising confidentiality, integrity and availability.", "risk_and_exploitability": "The CVSS score of 8.8 reflects high severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker must first authenticate to the DVRIP protocol on TCP port 34567. Once authenticated, a crafted HostName value can trigger the vulnerable system() call, giving the attacker unrestricted root access to the underlying operating system."}}}}, "created": "2026-03-29T20:31:17.459706+00:00", "title": "Root OS Command Injection via HostName Field in Xiongmai DVR/NVR", "updated": "2026-03-30T06:58:05.742128+00:00", "vendors": ["xiongmai", "xiongmai$PRODUCT$dvr/nvr_devices"]}