TI-2025-24205 CVE-2025-34036 · GHSA-ppp6-57cw-px5qShenzhen TVT CCTV-DVR Command InjectionPriority HIGH 82An OS command injection vulnerability exists in white-labeled DVRs manufactured by TVT, affecting a custom HTTP service called "Cross Web Server" that listens on TCP ports 81 and 82.CVSS 4.0CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.30915 · Published 2025-06-24 · No fix listed CWE-78