CVE-2024-3721

Published Apr 13, 2024

Last updated 7 months ago

TBK DVR

Overview

AI description

Automated description summarized from trusted sources.

CVE-2024-3721 is a command injection vulnerability affecting TBK DVR-4104 and DVR-4216 devices up to version 20240412. The vulnerability exists in the processing of the `/device.rsp` file, where manipulation of the `mdb/mdc` argument allows for remote attackers to execute arbitrary operating system commands. The vulnerability is triggered by constructing an OS command using externally influenced input without proper neutralization of special elements. An attacker can exploit this vulnerability remotely, meaning they don't need physical access to the device.

Description: A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical. This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___. The manipulation of the argument mdb/mdc leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260573 was assigned to this vulnerability.
Source: cna@vuldb.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 6.3
Impact score: 3.4
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Severity: MEDIUM

CVSS 2.0

Type: Secondary
Base score: 6.5
Impact score: 6.4
Exploitability score: 8
Vector string: AV:N/AC:L/Au:S/C:P/I:P/A:P

Weaknesses

cna@vuldb.com: CWE-78

Hype score: Not currently trending

References

Sources include official advisories and independent security research.