CVE-2025-34051 is a medium severity SSRF vulnerability in AVTECH DVR devices across numerous firmware versions. It allows unauthenticated attackers to access the /cgi-bin/nobody/Search.cgi?action=cgi_query endpoint and manipulate the ip, port, and queryb64str parameters to perform arbitrary HTTP requests from the device. This could expose sensitive information or allow interaction with internal network services. The vulnerability is identified as CWE-918 (Server-Side Request Forgery) and CWE-200 (Information Exposure). No patch or official remediation guidance is currently provided, and no known exploitation has been reported.

An attacker can exploit this vulnerability to make the vulnerable DVR device send arbitrary HTTP requests to internal or external systems. This may result in unauthorized access to sensitive data or interaction with internal services that are otherwise inaccessible externally. The impact is limited to the confidentiality and integrity of internal network resources accessible from the DVR. There is no indication of privilege escalation or direct device compromise from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the device is not a cloud service and no official fix is documented, users should monitor AVTECH communications for firmware updates addressing this vulnerability. Until a patch is available, restricting network access to the vulnerable endpoint and isolating affected devices from sensitive internal networks may reduce risk.