CVE-2024-3721

Name of the Vulnerable Software and Affected Versions TBK DVR-4104 versions up to 20240412 TBK DVR-4216 versions up to 20240412

Description A critical issue affects the processing of the file

/device.rsp?opt=sys&cmd=  S O S T R E A MAX  

. The manipulation of the argument

mdb/mdc

leads to os command injection. The attack may be initiated remotely.

Recommendations For TBK DVR-4104 versions up to 20240412, consider restricting access to the

/device.rsp

endpoint until a patch is available. For TBK DVR-4216 versions up to 20240412, consider restricting access to the

/device.rsp

endpoint until a patch is available. As a temporary workaround, avoid using the

mdb/mdc

argument in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.