Hackers Exploiting 5-year-old Unpatched Vulnerability in TBK DVR Devices

Threat actors are actively exploiting an unpatched five-12 months-outdated flaw impacting TBK electronic video recording (DVR) equipment, in accordance to an advisory issued by Fortinet FortiGuard Labs.

The vulnerability in dilemma is CVE-2018-9995 (CVSS score: 9.8), a critical authentication bypass issue that could be exploited by remote actors to achieve elevated permissions.

“The 5-12 months-outdated vulnerability (CVE-2018-9995) is because of to an mistake when handling a maliciously crafted HTTP cookie,” Fortinet claimed in an outbreak warn on May well 1, 2023. “A distant attacker might be equipped to exploit this flaw to bypass authentication and get administrative privileges sooner or later leading entry to camera video feeds.”

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

The network security firm explained it observed around 50,000 tries to exploit TBK DVR gadgets applying the flaw in the month of April 2023. Despite the availability of a proof-of-idea (PoC) exploit, there are no fixes that handle the vulnerability.

The flaw impacts TBK DVR4104 and DVR4216 solution strains, which are also rebranded and marketed applying the names CeNova, DVR Login, HVR Login, MDVR Login, Evening OWL, Novo, QSee, Pulnix, Securus, and XVR 5 in 1.

Additionally, Fortinet warned of a surge in the exploitation of CVE-2016-20016 (CVSS score: 9.8), yet another critical vulnerability affecting MVPower CCTV DVR versions, like Tv-7104HE 1.8.4 115215B9 and Tv7108HE.

Impending WEBINARLearn to End Ransomware with Authentic-Time Safety

Join our webinar and study how to end ransomware attacks in their tracks with genuine-time MFA and provider account security.

Save My Seat!

The flaw could permit a distant unauthenticated attacker to execute arbitrary operating technique instructions as root thanks to the existence of a web shell that is accessible in excess of a /shell URI.

“With tens of hundreds of TBK DVRs obtainable below unique manufacturers, publicly-accessible PoC code, and an straightforward-to-exploit makes this vulnerability an straightforward concentrate on for attackers,” Fortinet observed. “The current spike in IPS detections displays that network digicam products continue being a well-known goal for attackers.”

Observed this report interesting? Adhere to us on Twitter  and LinkedIn to go through far more exclusive written content we put up.