CVE-2021-47707 CRITICAL

CVE-2021-47707: COMMAX CVD-Axx DVR Weak Default Credentials Stream Disclosure

Vendor Commax Co., Ltd.
Product COMMAX CVD-Axx DVR
Weakness CWE-1392
Published December 9, 2025
Last update April 7, 2026
View on NVD All CVEs

CVSS base score

9.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

COMMAX CVD-Axx DVR 5.1.4 contains weak default administrative credentials that allow remote password attacks and disclose RTSP stream. Attackers can exploit this by sending a POST request with the 'passkey' parameter set to '1234', allowing them to access the web control panel.

Key dates

02Disclosure timeline

December 9, 2025 CVE published
April 7, 2026 Record updated