Loading vulnerability…
JAWS webserver RCE
CVE-2016-20016 is an unauthenticated remote command execution vulnerability in MVPower CCTV DVR devices caused by an exposed web shell. Affected models include TV-7104HE running firmware 1.8.4 115215B9 and TV7108HE; other firmware versions dating from at least 2014 through 2019 may also be affected. Remote attackers can execute arbitrary operating system commands with root privileges. The vulnerability is commonly called JAWS webserver RCE because affected webservers expose an identifiable HTTP Server response field. Exploitation was documented from 2017 through 2022, with subsequent botnet campaigns continuing to incorporate the vulnerability.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation gives an unauthenticated remote attacker root-level command execution on the DVR. This enables attacker control of the operating system and deployment of malicious software. Multiple botnets incorporate this vulnerability for infection or self-propagation, including Mirai.TBOT, ClingSTUN, ToxNetV2, AIRASHI, Dysphoria, and Gayfemboy.
If you can’t patch tonight, do this now.
Restrict inbound access to the DVR web service and disable unnecessary Internet-facing services. Isolate unsupported devices and use network segmentation to limit exposure and the consequences of compromise. Monitor exposed DVRs for exploitation attempts and unexpected process or network activity.
Patch, then assume compromise.
A vendor-confirmed fixed firmware version is currently not available in the supplied vulnerability information. Apply available security updates after verifying that they remove or secure the exposed web shell. Replace affected devices that no longer receive security updates.
1 exploit validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
26 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.