Security News > 2023 > May > Attackers are trying to exploit old DVR vulnerabilities (CVE-2018-9995, CVE-2016-20016)

CVE-2018-9995 is an authentication bypass vulnerability that can be triggered with a simple exploit sent via a maliciously crafted HTTP cookie to a vulnerable DVR device.

The device responds by sending back the device's admin credentials in clear text.

With those credentials in hand, the attacker can access the DVR device, take it over, and access to connected camera's live video feeds.

"According to the NIST NVD database, TBK DVR4104 and DVR4216 devices are also rebranded and sold as other brands such as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR," FortiGuard Labs pointed out.

The pool of potentially exploitable devices may be considerable.

"With tens of thousands of TBK DVRs available under different brands, publicly-available PoC code, and an easy-to-exploit makes this vulnerability an easy target for attackers. The recent spike in IPS detections shows that network camera devices remain a popular target for attacker," the company said.

News URL

https://www.helpnetsecurity.com/2023/05/03/cve-2018-9995-cve-2016-20016/