Lucene search

VulDBCVELIST:CVE-2024-3721

HistoryApr 13, 2024 - 12:00 p.m.

CVE-2024-3721 TBK DVR-4104/DVR-4216 os command injection

2024-04-1312:00:04

CWE-78

VulDB

www.cve.org

vulnerability

tbk dvr-4104

dvr-4216

critical

file processing

os command injection

remote attack

exploit

vdb-260573

disclosure

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

6.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

AI Score

7.1

Confidence

High

EPSS

0.001

Percentile

16.3%

JSON

A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical. This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=S_O_S_T_R_E_A_MAX. The manipulation of the argument mdb/mdc leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260573 was assigned to this vulnerability.

CNA Affected

[
  {
    "vendor": "TBK",
    "product": "DVR-4104",
    "versions": [
      {
        "version": "20240412",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "TBK",
    "product": "DVR-4216",
    "versions": [
      {
        "version": "20240412",
        "status": "affected"
      }
    ]
  }
]

References

github.com/netsecfish/tbk_dvr_command_injection

vuldb.com/?ctiid.260573

vuldb.com/?id.260573

vuldb.com/?submit.314969

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

6.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

AI Score

7.1

Confidence

High

EPSS

0.001

Percentile

16.3%

JSON

Related for CVELIST:CVE-2024-3721