Two high-severity vulnerabilities in TP-Link VIGI network video recorder (NVR) systems could allow attackers to execute arbitrary commands on affected devices. Specifically affected are VIGI NVR1104H-4P V1 devices running firmware versions prior to 1.1.5 Build 250518 and VIGI NVR2016H-16MP V2 systems with firmware versions before 1.3.1 Build 250407. Users must upgrade VIGI NVR1104H-4P V1 systems to firmware version 1.1.5 Build 250518 and VIGI NVR2016H-16MP V2 devices to version 1.3.1 Build 250407. CVE-2025-7723 is a high-severity operating system (OS) command injection vulnerability, which allows attackers with authenticated access to inject and execute arbitrary OS-level commands on the affected devices. The security flaws, identified as CVE-2025-7723 and CVE-2025-7724, impact the VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2 models, posing significant risks to surveillance infrastructure security. Two serious vulnerabilities let attackers run commands on TP-Link VIGI NVR devices. Successful exploitation can fully compromise the device’s confidentiality, integrity, and availability, allowing attackers to tamper with stored video data, disrupt operations, or launch further attacks within the local network. Network administrators should download the latest firmware directly from TP-Link’s official support channels and implement additional network segmentation measures to limit potential attack surfaces.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 24 Jul 2025 17:35:13 +0000