An authentication bypass vulnerability (CWE-290) exists in the streamd web server component of AVTECH IP camera, DVR, and NVR devices. The issue is due to the use of the strstr() function to identify ".cab" requests, which inadvertently allows any URL containing the substring ".cab" to bypass authentication controls. This enables unauthorized access to protected endpoints on affected devices. The vulnerability impacts numerous firmware versions across AVTECH's product line. The CVSS 4.0 score is 6.9 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, and no user interaction needed. No patch or official fix has been documented, and no known exploits have been reported.

Successful exploitation of this vulnerability allows an unauthenticated attacker to bypass authentication mechanisms on AVTECH IP camera, DVR, and NVR devices, potentially gaining unauthorized access to protected web server endpoints. This could lead to unauthorized viewing or control of device functions depending on the endpoints accessed. The medium CVSS score reflects a significant but not critical risk. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to affected devices to trusted networks only and monitor for unusual access patterns involving URLs containing ".cab". Avoid exposing these devices directly to untrusted networks such as the internet.