Statement on authenticated and unauthenticated command injection on VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2 (CVE-2025-7723 and CVE-2025-7724)

Vulnerability Description:

The authenticated and unauthenticated OS command injection vulnerabilities exist in VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2. The issues affect VIGI NVR1104H-4P V1: before 1.1.5 Build 250518 and VIGI NVR2016H-16MP V2: before 1.3.1 Build 250407.

Impact:

Attackers may execute arbitrary commands on the device’s underlying operating system.

CVE-2025-7723:

CVSS v4.0 Score: 8.5 / High

CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVE-2025-7724:

CVSS v4.0 Score: 8.7 / High

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected Products/Versions and Fixes:

Recommendation(s):

We strongly recommended that users with the affected device(s) take the following action(s):

1. Download and update to the latest firmware to fix the vulnerabilities.
2. Check the configurations of the device after the firmware upgrade to ensure that all settings remain accurate, secure, and aligned with their intended preferences.

The latest firmware of related models and download links are below:

https://www.tp-link.com/jp/support/download/vigi-nvr1104h-4p/#Firmware

https://www.tp-link.com/jp/support/download/vigi-nvr2016h-16mp/#Firmware

Disclaimer:

If you do not take the recommended action(s) stated above, this vulnerability concern will remain. TP-Link cannot bear any responsibility for the consequences that could have been avoided by following the recommended action(s) in this statement.