GCVE - cpe:2.3:h:tbkvision:tbk-dvr4104:-:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:h:tbkvision:tbk-dvr4104:-:*:*:*:*:*:*:*

part: h version: - update: *

Vendor	Tbkvision (`bed4a7b8-4482-5245-a2c8-59a12fbe119f`)
Product	Tbk Dvr4104 (`245bf002-dff2-54a9-a218-d8099f3d474b`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-3721`	vulnerable	2026-06-08 06:43:51.287631	TBK DVR-4104/DVR-4216 os command injection MEDIUM (6.3) A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical. This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___. The manipulation of the argument mdb/mdc leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260573 was assigned to this vulnerability. Published: 2024-04-13T12:00:04.795Z Updated: 2024-08-01T20:20:00.692Z Open on db.gcve.eu Reference links https://vuldb.com/?id.260573 https://vuldb.com/?ctiid.260573 https://vuldb.com/?submit.314969 https://github.com/netsecfish/tbk_dvr_command_injection	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-9995`	not_vulnerable	2026-06-08 05:12:08.417971	Details available TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login, which run re-branded versions of the original TBK DVR4104 and DVR4216 series, allow remote attackers to bypass authentication via a "Cookie: uid=admin" header, as demonstrated by a device.rsp?opt=user&cmd=list request that provides credentials within JSON data in a response. Published: 2018-04-10T22:00:00.000Z Updated: 2024-08-05T07:32:01.171Z Open on db.gcve.eu Reference links https://www.bleepingcomputer.com/news/security/new-hacking-tool-lets-users-access-a-bunch-of-dvrs-and-their-video-feeds/ https://www.exploit-db.com/exploits/44577/ http://misteralfa-hack.blogspot.cl/2018/04/tbk-vision-dvr-login-bypass.html http://misteralfa-hack.blogspot.cl/2018/04/update-dvr-login-bypass-cve-2018-9995.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-10676`	not_vulnerable	2026-06-08 05:10:36.932490	Details available CeNova, Night OWL, Novo, Pulnix, QSee, Securus, and TBK Vision DVR devices allow remote attackers to download a file and obtain sensitive credential information via a direct request for the download.rsp URI. Published: 2018-05-02T18:00:00.000Z Updated: 2024-09-17T02:06:41.186Z Open on db.gcve.eu Reference links http://misteralfa-hack.blogspot.cl/2018/05/0day-dvr-multivendor.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.