VIGI NVR Command Injection Vulnerability

A command injection vulnerability allowing unauthenticated OS command execution exists in the VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2 models. For VIGI NVR1104H-4P V1, this vulnerability affects versions prior to 1.1.5 Build 250518. For VIGI NVR2016H-16MP V2, the vulnerable versions are prior to 1.3.1 Build 250407.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the device's operating system.

Remediation

Users are advised to update to VIGI NVR1104H-4P V1 version 1.1.5 Build 250518 or VIGI NVR2016H-16MP V2 version 1.3.1 Build 250407. The latest firmware for both models can be downloaded from the TP-Link VIGI support website.