vulnwire
9.8crit

CVE-2018-9995in critical feed1 exploitNuclei template

TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Logi…

Published 8 y ago · modified 4 mo ago · JSON

CVSS
9.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
82.3%
percentile 100%
Public exploits
1
Exploit-DB · Nuclei check

TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login, which run re-branded versions of the original TBK DVR4104 and DVR4216 series, allow remote attackers to bypass authentication via a "Cookie: uid=admin" header, as demonstrated by a device.rsp?opt=user&cmd=list request that provides credentials within JSON data in a response.

Exploit prediction (EPSS)

82.32% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

  • Nuclei template TBK DVR4104/DVR4216 Devices - Authentication Bypass · nuclei detection template
  • EDB-44577 TBK DVR4104 / DVR4216 - Credentials Leak · remote · 2018-05-02

CVSS scores

Assigned byVersionScoreVector
NVD3.09.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.05.0AV:N/AC:L/Au:N/C:P/I:N/A:N

References

  • bleepingcomputer.com /news/security/new-hacking-tool-lets-users-access-a-bunch-of-dvrs-and-their-video-feeds/ · x_refsource_MISC, x_transferred
  • exploit-db.com /exploits/44577/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • misteralfa-hack.blogspot.cl /2018/04/tbk-vision-dvr-login-bypass.html · x_refsource_MISC, x_transferred
  • misteralfa-hack.blogspot.cl /2018/04/update-dvr-login-bypass-cve-2018-9995.html · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.