Loading vulnerability…
Unauthenticated OS Command Injection in TBK DVR-4104 and DVR-4216
CVE-2024-3721 is an OS command injection vulnerability affecting TBK DVR-4104 and DVR-4216 digital video recorders through version 20240412. Manipulation of the mdb and mdc arguments in the device's HTTP system-request handler allows remote, unauthenticated attackers to execute arbitrary operating-system commands. A public exploit is available, and the vulnerability has been exploited in botnet campaigns involving Mirai variants, including Nexcorium and Broadside.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables arbitrary command and code execution on affected DVRs, allowing attackers to deploy malware and remotely control the devices. Observed campaigns use compromised DVRs for persistent botnet infections, further propagation, and DDoS attacks. Broadside-generated traffic could saturate vessel networks and satellite communications. Successful privilege escalation or lateral movement in that campaign has not been established.
If you can’t patch tonight, do this now.
Disable unnecessary remote access and restrict DVR management access to trusted networks or a secure VPN. Isolate DVRs from critical operational systems using network segmentation. Monitor unusual traffic and signs of botnet infection. Replace default credentials with strong, unique passwords to reduce additional compromise and propagation risks; credential changes alone do not prevent this unauthenticated command injection. An IPS signature specifically targeting exploitation of CVE-2024-3721 is available from FortiGuard.
Patch, then assume compromise.
Apply a vendor-confirmed firmware update addressing CVE-2024-3721 where available. Patch availability is uncertain: some accounts state that TBK released a patch, while another states that the affected devices are end-of-life and unpatched. No confirmed fixed firmware version is available. Replace or retire affected devices if a supported security update cannot be obtained.
1 exploit validated by Mallory's analysis. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
112 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.