CVE-2025-10264

Digiever｜NVR - Exposure of Sensitive Information

Critical10.0EPSS 0.50%

Published: 12 Sept 2025
Updated: 12 Sept 2025
Reserved: 11 Sept 2025
Assigned by: twcert

Description

Certain models of NVR developed by Digiever has an Exposure of Sensitive Information vulnerability, allowing unauthenticated remoter attackers to access the system configuration file and obtain plaintext credentials of the NVR and its connected cameras.

Timeline

2025
11 Sept 2025
11 Sept 2025
ID reserved
By twcert
12 Sept 20251 day later
12 Sept 2025· 1 day later
Published

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2025-10264, by who scored it
Scored by	CVSS	Score	Vector
twcertCNA (assigner)	4.0	Critical10.0	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
twcertCNA (assigner)	3.1	Critical10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVDNVD · Deferred	4.0	Critical10.0	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.50% · top 57% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: yes · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 10.0.

Weakness

CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere (opens in a new tab)All about CWE-497 and its CVEs

Affected products

Digiever · DS-1200
- affected ≤ *.*.*.78
Digiever · DS-2100 Pro
- affected ≤ *.*.*.78
Digiever · DS-2100 Pro+
- affected ≤ *.*.*.78
Digiever · DS-2100 UHD
- affected ≤ *.*.*.78
Digiever · DS-2200 UHD
- affected ≤ *.*.*.78
Digiever · DS-2200 UHD+
- affected ≤ *.*.*.78
Digiever · DS-4200 Pro
- affected ≤ *.*.*.78
Digiever · DS-4200 Pro+
- affected ≤ x.x.x.78
Digiever · DS-4200 UHD
- affected ≤ x.x.x.78
Digiever · DS-4200 UHD+
- affected ≤ x.x.x.78
Digiever · DS-4100-RM
- affected ≤ x.x.x.78
Digiever · DS-4200-RM Pro+
- affected ≤ x.x.x.78
Digiever · DS-4200-RM UHD
- affected ≤ x.x.x.78
Digiever · DS-8x00-RM Pro+
- affected ≤ x.x.x.78
Digiever · DS-8x00-SRM Pro+
- affected ≤ x.x.x.78
Digiever · DS-8x00-RM UHD
- affected ≤ x.x.x.78
Digiever · DS-16x00-RM Pro+
- affected ≤ x.x.x.78
Digiever · DS-16x00-RM UHD
- affected ≤ x.x.x.78

What to do

Solution: Update firmware version to x.x.x.79 and later

References (2)

https://www.twcert.org.tw/tw/cp-132-10375-19f1e-1.html (opens in a new tab)third-party-advisory
https://www.twcert.org.tw/en/cp-139-10376-a057c-2.html (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2025-10264](https://trackcve.app/badge/CVE-2025-10264.svg)](https://trackcve.app/cve/CVE-2025-10264)

Record last updated 12 Sept 2025, 15:52 UTC.