CVE-2025-57201

Public exploit available. Not confirmed exploited in the wild yet. A vendor fix is available.

CVSS 3.18.8High EPSS percentile97th17% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 2 sources FixVendor fixNo build named by the sources

Published 2025-12-03Updated 2026-07-05Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether you use AVTECH DGM1104 or any of these models: avm1203, avm2200, avm2200t, avm2220, avm2220se, avm2220t, avm301, avm302a.
On each device, confirm whether the SMB server function is enabled and reachable from other computers/networks.
If SMB is reachable, restrict access using firewall rules so only the specific management/workstation IPs can reach SMB (block it for everyone else).
Ask your vendor/AVTECH support for the exact firmware fix for CVE-2025-57201 for your model, or apply the vendor-provided remediation/firmware update when available.
After changes, monitor authentication logs for unusual SMB logins and investigate any suspicious command or error activity around the SMB service.

Some work to apply

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability in the SMB server function. This vulnerability allows attackers to execute arbitrary commands via a crafted input.

In plain language

Written by AI from the record

This is a flaw in certain AVTECH devices (like DGM1104 and several AVM models) that can let someone run commands on your network if they can reach the device’s SMB service with valid access; a typical small business should address it if those devices are exposed or used over the network.

AVTECH DGM1104 and related AVM models contain an authenticated command injection in the SMB server function, where crafted SMB inputs can trigger execution of arbitrary commands on the device; exploitation requires low-privilege authentication and network reachability to the SMB service.

If you're affected

Device full compromise
Service disruption
Network spread risk
Data loss from device

What is it

Your device has an SMB file-sharing feature. With this bug, a user who can log in with low privileges and reach that service may be able to send special input that makes the device run unintended commands—like tricking the device into doing the attacker’s “orders” instead of normal file-sharing tasks.

Who is affected

This matters if your business uses AVTECH network video/storage devices, specifically AVTECH DGM1104 and the listed AVM models (avm1203, avm2200, avm2200t, avm2220, avm2220se, avm2220t, avm301, avm302a). The attack requires network access to the SMB server and authenticated access with low privileges; if SMB is not reachable from where an attacker can reach it, the risk is reduced.

How urgent is it

Treat this as AMBER because command injection can lead to full device control, and there are public proofs of concept available. The vulnerability is authenticated with low privilege, so it can be a realistic risk in environments where SMB access isn’t tightly limited; prioritize restricting SMB access now while you seek an official firmware fix.

What to do — in detail

Inventory and exposure check
- Confirm whether you have AVTECH DGM1104 or any of: avm1203, avm2200, avm2200t, avm2220, avm2220se, avm2220t, avm301, avm302a.
- For each device, identify its IP address and where SMB is exposed (internal VLAN, guest network, or internet).
Confirm SMB service reachability
- From a non-admin workstation (or your network scanner), verify whether TCP/445 (SMB) is reachable from unintended segments.
- Review the device’s network/service settings to see whether the SMB server function is enabled.
Apply the vendor’s compensating control (immediate mitigation)
- Implement firewall rules to restrict SMB access to only the specific, required source IPs (for example, only your management PC(s)).
- Block SMB for all other sources/segments, including guest networks and any broad “LAN-to-device” rules.
Obtain and apply the real fix
- Contact AVTECH support or check the vendor advisory for CVE-2025-57201 and your exact model.
- Install the fixed firmware/update version(s) provided by the vendor for your device model.
Validate after changes
- Re-test reachability to ensure SMB is not accessible from unapproved networks.
- Check logs for unusual SMB login attempts and any abnormal errors around SMB operations.
Temporary workaround if patching is delayed
- Keep SMB access restricted via firewall as the primary workaround until patched firmware is installed.
What to monitor going forward
- Repeated failed/successful SMB logins from unexpected IPs.
- Any spikes in SMB-related activity outside normal business hours.

CISA KEV: Not listed in the provided findings.

Technical context

CVE-2025-57201 is a CWE-77 (command injection) in the AVTECH DGM1104 SMB server function and applies to the listed AVM-family models. The mechanism is authenticated command injection: an attacker must reach the SMB service over the network and provide crafted SMB input that results in execution of arbitrary commands on the device. The findings indicate public proof-of-concept code exists (GitHub) and the predicted likelihood is rising, but KEV is not listed in the provided data. This is exploitation risk driven by network reachability plus low-privilege authenticated access; therefore, environments that expose SMB broadly are more exposed than those that tightly restrict SMB to trusted admin hosts.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS97th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

2 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

17% chance of exploitation activity in the next 30 days, which ranks it in the 97th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

A public exploit existed 120 days before the patch.

2026-07-05EPSS band change0 → moderateepss band change, patch available, patch available, record updated, record updated
2026-03-07Public exploit / PoCsource: github-poc
2025-12-03Publishedweakness classified, att&ck mapped

Affected products

AVTECH SECURITY Corporationcommercialaka avtech security
avtechcommercial · CNaka dgm1104 firmware, avn801 dvr firmware
- dgm1104 firmwareEmbeddedICS / OT / IoT / ip-camera-nvr

And 93 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 8.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable