CVE-2025-7723
High
Description
A command injection vulnerability exists that can be exploited after authentication in VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2.This issue affects VIGI NVR1104H-4P V1: before 1.1.5 Build 250518; VIGI NVR2016H-16MP V2: before 1.3.1 Build 250407.
SeverityHigh
CVSS8.5
Exploit probability—
ProductVIGI NVR1104H-4P V1
PublishedJul 22, 2025
First seenJul 22, 2025
Weakness typeCWE-78OS command injection
How to fix
Update
- TP-Link Systems Inc. VIGI NVR1104H-4P V11.1.5 Build 250518 or later
- TP-Link Systems Inc. VIGI NVR2016H-16MP V21.3.1 Build 250407 or later
Patches
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| TP-Link Systems Inc. VIGI NVR1104H-4P V1 | v < 1.1.5 Build 250518 | 1.1.5 Build 250518 |
| TP-Link Systems Inc. VIGI NVR2016H-16MP V2 | v < 1.3.1 Build 250407 | 1.3.1 Build 250407 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.