PT-2024-27378 · Tbk · Tbk Dvr-4104+1
Netsecfish
·
Published
2024-04-13
·
Updated
2026-05-09
·
CVE-2024-3721
CVSS v2.0
6.5
Medium
| Vector | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
TBK DVR-4104 versions prior to 20240412
TBK DVR-4216 versions prior to 20240412
Description
An OS command injection issue exists in TBK DVR devices due to insufficient validation of user-supplied input. Remote, unauthenticated attackers can execute arbitrary shell commands or cause a denial of service by sending a specially crafted POST request to the endpoint '/device.rsp?opt=sys&cmd= S O S T R E A MAX ' by manipulating the
mdb and mdc parameters. This flaw has been actively exploited by several Mirai botnet variants, including Nexcorium and Broadside, to hijack devices for large-scale DDoS attacks and malicious traffic proxying. Over 50,000 infected devices have been detected globally, with significant activity in China, India, Russia, Egypt, Turkey, and Brazil. The Broadside variant specifically targets the maritime logistics and shipping sector, posing risks to shipboard systems and satellite communications.Recommendations
Update the firmware for TBK DVR-4104 and TBK DVR-4216 to a version released after 20240412.
Disable Telnet and restrict external access to the devices.
Change all default user credentials.
As a temporary workaround, restrict access to the '/device.rsp' endpoint to minimize the risk of exploitation.
Exploit
Fix
DoS
RCE
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Tbk Dvr-4104
Tbk Dvr-4216