CVE-2024-3721CWE-78

TBK DVR-4104/DVR-4216 os command injection

Medium · published April 13, 2024

Patch now

High probability of exploitation

CVSS calls it medium at 6.3. It sits in the 99.7th percentile for exploit probability.

CVSS v3.1

6.3

EPSS

86%

Percentile

99.7

In the wild

Unconfirmed

What it is

A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical. This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___. The manipulation of the argument mdb/mdc leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260573 was assigned to this vulnerability.

The record

Technical detail

CVSS v3.1: 6.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0: Not supplied
EPSS: 0.86489 · 99.7th percentile
Weakness: CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published: 2024-04-13T12:00Z

EPSS history

Timeline

13 APR 12:00Z
TBK DVR-4104/DVR-4216 os command injection
cvelistv5