An OS command injection vulnerability (CWE-78) affects Shenzhen TVT CCTV-DVR devices via a custom HTTP service called 'Cross Web Server' on TCP ports 81 and 82. The vulnerability arises because the web interface fails to properly sanitize the [lang] parameter in the URI path /language/[lang]/index.html before using it in a tar extraction shell command. This allows unauthenticated remote attackers to inject arbitrary shell commands, resulting in root-level command execution. The vulnerability was publicly disclosed with a CVSS 4.0 score of 10.0 and exploitation evidence was observed by Shadowserver Foundation on 2025-02-06. No patches or mitigations have been published by the vendor as of the last update.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary commands as root on affected Shenzhen TVT CCTV-DVR devices. This can lead to full system compromise, including control over the device and potential lateral movement within the network. The vulnerability is critical due to the lack of authentication required and the root-level impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected TCP ports (81 and 82) to trusted users only and consider disabling the vulnerable HTTP service if possible. Monitor vendor channels for updates and apply patches promptly once released.