CVE-2018-9995

High PUBLISHED

TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login, which...

Vendor: TBK Product: DVR4104, DVR4216

Not yet in CISA KEV

Exploited in the wild PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

Browse all known exploited vulnerabilities Talk to Sales

Confidence

High

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

Not yet in CISA KEV

CVSS / EPSS

9.8 Critical EPSS 83.2%

At a Glance

TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login, which run re-branded versions of the original TBK DVR4104 and DVR4216 series, allow remote attackers to bypass authentication via a "Cookie: uid=admin" header, as demonstrated by a device.rsp?opt=user&cmd=list request that provides credentials within JSON data in a response.

nuclei_scanner

CVE Published: Apr 10, 2018
Exploitation Reported: Apr 23, 2025
CVSS: 9.8 Critical
EPSS: 83.2%

Remote Low complexity No user interaction Unauthenticated

CVE References

44577 exploit-db.com · Exploit https://www.exploit-db.com/exploits/44577/
bleepingcomputer.com/news/security/new-hacking-tool-lets-users-ac... bleepingcomputer.com · CVE Record https://www.bleepingcomputer.com/news/security/new-hacking-tool-lets-...
misteralfa-hack.blogspot.cl/2018/04/tbk-vision-dvr-login-bypass.html misteralfa-hack.blogspot.cl · CVE Record http://misteralfa-hack.blogspot.cl/2018/04/tbk-vision-dvr-login-bypas...
misteralfa-hack.blogspot.cl/2018/04/update-dvr-login-bypass-cve-2018-999... misteralfa-hack.blogspot.cl · CVE Record http://misteralfa-hack.blogspot.cl/2018/04/update-dvr-login-bypass-cv...

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
The Shadowserver First	2025-04-28 00:00 UTC

Scanner Artifacts

Scanner and exploit-framework references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-9995.yaml	Apr 25, 2025

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2018-9995

{
  "cve_id": "CVE-2018-9995",
  "title": "TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5...",
  "affected_vendor": "TBK",
  "affected_product": "DVR4104, DVR4216",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "High",
  "cvss_score": 9.8,
  "epss_score": 0.83151,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2018-9995

At a Glance

CVE References

Known Exploited Vulnerability Sources

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Scanner Integrations

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API