Vulnerability · Published Apr 13, 2024 · Assigned by VulDB

CVE-2024-3721TBK DVR-4104/DVR-4216 os command injection

Medium 6.3

In plain English

A medium-severity OS command injection in DVR-4104 from TBK. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 86.5% (higher than 99.7% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)86.5%top 0.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical. This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___. The manipulation of the argument mdb/mdc leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260573 was assigned to this vulnerability.

Affected products (as reported)

Vendor	Product	Versions
TBK	DVR-4104	20240412
TBK	DVR-4216	20240412

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

VDB-260573 | TBK DVR-4104/DVR-4216 os command injection vdb-entry, technical-description
VDB-260573 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #314969 | TBK TBK DVR-4104, TBK DVR-4216 N/A Command Injection third-party-advisory
https://github.com/netsecfish/tbk_dvr_command_injection exploit