Back to KEVs

CVE-2024-3721

TBK DVR-4104/DVR-4216 os command injection

Basic Information

CVE State
PUBLISHED
Reserved Date
April 12, 2024
Published Date
April 13, 2024
Last Updated
August 01, 2024
Vendor
TBK
Product
DVR-4104, DVR-4216
Description
A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical. This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___. The manipulation of the argument mdb/mdc leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260573 was assigned to this vulnerability. Eine kritische Schwachstelle wurde in TBK DVR-4104 and DVR-4216 bis 20240412 gefunden. Betroffen davon ist ein unbekannter Prozess der Datei /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___. Mittels dem Manipulieren des Arguments mdb/mdc mit unbekannten Daten kann eine os command injection-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung.
Tags
mirai malware

CVSS Scores

CVSS v3.1

6.3 - MEDIUM

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CVSS v3.0

6.3 - MEDIUM

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CVSS v2.0

6.5

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS Score

Score
50.99% (Percentile: 97.70%) as of 2025-05-26

SSVC Information

Exploitation
poc
Technical Impact
partial

Exploit Status

Exploited in the Wild
Yes (2025-05-05 00:00:00 UTC) Source

References

https://vuldb.com/?id.260573 https://vuldb.com/?ctiid.260573 https://vuldb.com/?submit.314969 https://github.com/netsecfish/tbk_dvr_command_injection

Known Exploited Vulnerability Information

Source Added Date
The Shadowserver (via CIRCL) 2025-04-28 00:00:00 UTC

Recent Mentions

New Mirai Botnet Variant Targets Flaw in 50,000 Exposed TBK DVRs

Source: CyberInsider • Published: 2025-06-06 14:45:00 UTC

A new wave of Mirai botnet activity is exploiting a recently disclosed vulnerability in TBK DVR devices, CVE-2024-3721, to infect internet-connected systems with a custom ARM32 malware variant designed to evade analysis and sustain persistent remote control. Kaspersky uncovered the exploitation attempt while monitoring honeypots. The campaign targets a command injection flaw in TBK DVR-4104 … The post New Mirai Botnet Variant Targets Flaw in 50,000 Exposed TBK DVRs appeared first on CyberInsider.

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Added to KEVIntel