CVE-2024-3721

TBK DVR-4104/DVR-4216 os command injection

CVSS 6.3 MEDIUMEPSS 86.5%CWE-78

Vexday Risk Score

35Atenção

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 6.3EPSS 86.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

13 abr 2024Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical. This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___. The manipulation of the argument mdb/mdc leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260573 was assigned to this vulnerability.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Produtos afetados

TBK · DVR-4104 TBK · DVR-4216

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/netsecfish/tbk_dvr_command_injection https://vuldb.com/?ctiid.260573 https://vuldb.com/?id.260573 https://vuldb.com/?submit.314969