CVE-2025-34043 is a critical remote OS command injection vulnerability affecting Vacron Network Video Recorder (NVR) devices at version 1.4. The issue arises from improper neutralization of special elements in the board.cgi script, allowing unauthenticated attackers to inject arbitrary commands through crafted HTTP requests. These commands execute with the privileges of the web server process, enabling remote code execution and potential full device compromise. The vulnerability was publicly disclosed in June 2025 with a CVSS 4.0 base score of 10.0. No official patch or vendor advisory is currently available, and the product is not a cloud service. Exploitation activity was observed by Shadowserver Foundation on February 6, 2025.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary operating system commands on the affected device with the privileges of the web server process. This can lead to complete compromise of the device, including unauthorized control, data access, and potential pivoting within the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected device, especially blocking untrusted external HTTP requests to the board.cgi script. Monitor for unusual activity and consider isolating affected devices to reduce risk.