CVE-2025-5113

Description

The Diviotec professional series exposes a web interface. One endpoint is vulnerable to arbitrary command injection and hardcoded passwords are used.

Reserved 2025-05-23 | Published 2025-06-02 | Updated 2025-06-02 | Assigner ONEKEY

Problem types

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

Product status

Default status
affected

Any version
affected

Default status
affected

Any version
affected

Default status
affected

Any version
affected

Default status
affected

Any version
affected

Default status
affected

Any version
affected

Default status
affected

Any version
affected

Default status
affected

Any version
affected

Default status
affected

Any version
affected

Default status
affected

Any version
affected

Timeline

2025-03-04:	Notification email sent to sales@diviotec.com
2025-04-15:	Notification email sent to sales@diviotec.com, support@diviotec.com, security@diviotec.com, psirt@diviotec.com, csirt@diviotec.com
2025-04-27:	Notification email sent to sales@diviotec.com, support@diviotec.com, security@diviotec.com, psirt@diviotec.com, csirt@diviotec.com, and Nexcom personal emails

Credits

ONEKEY Research Labs finder

References

www.onekey.com/...cution-on-diviotec-ip-camera-cve-2025-5113 third-party-advisory

cve.org (CVE-2025-5113)

nvd.nist.gov (CVE-2025-5113)

Download JSON