This vulnerability (CVE-2025-34065) involves an authentication bypass in AVTECH IP camera, DVR, and NVR devices due to improper handling of URL requests by the streamd web server. Specifically, the strstr() function allows any request containing the substring "/nobody" to bypass authentication controls, granting unauthenticated access. The issue affects a wide range of firmware versions. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with low confidentiality, integrity, and availability impacts. No patch or official remediation guidance is currently available.

An attacker can bypass authentication controls on affected AVTECH devices by exploiting the strstr() function behavior, potentially gaining unauthorized access to device functionality or data. The impact is rated medium severity with limited confidentiality, integrity, and availability impact. There are no known active exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to affected devices and monitor for suspicious activity involving URLs containing "/nobody". Avoid exposing these devices directly to untrusted networks.