Digiever NVR Flaws (CVE-2025-10264, CVE-2025-10265) Let Hackers Steal Credentials & Take Control

Two critical flaws in Digiever’s Network Video Recorder (NVR) products—CVE-2025-10264 (CVSS 10) and CVE-2025-10265 (CVSS 9.8)—have been flagged by the Taiwan Computer Emergency Response Team (TWCERT/CC) for exposing systems to credential theft and remote code execution.

CVE-2025-10264 allows unauthenticated remote attackers to retrieve the system’s configuration file, which contains plaintext credentials for the NVR and its connected cameras; CVE-2025-10265 enables unauthenticated attackers to inject and execute arbitrary operating system commands on the device, potentially giving them full control.

According to TWCERT/CC, exploitation requires no prior authentication, making exposed NVRs connected to the internet particularly at risk, and attackers could use stolen credentials to monitor or tamper with live feeds or disable surveillance.

The vulnerabilities affect a wide range of Digiever NVR models, including the DS-1200, DS-2100 Pro, DS-2200 UHD, DS-4200 Pro, DS-4100-RM, DS-8×00-RM Pro+, DS-16×00-RM UHD, among others, with all firmware versions up to and including x.x.x.78 affected; administrators are urged to update to firmware version x.x.x.79 or later.