SECURITY_THREAT_PULSE
LIVE
LAST UPDATED
FIRST SEEN
4 SOURCES ON THIS EVENT
◆ WATCHCVE-2018-9995

CVE-2018-9995: attackers can get in without a password

DO THIS FIRSTFind out if you use it. If you do, apply the vendor's fix. Not sure if you use it? Send this page to your IT provider or security lead and ask.

TECHNICAL SUMMARY TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login, which run re-branded versions of the original TBK DVR4104 and DVR4216 series, allow remote attackers to bypass authentication via a "Cookie: uid=admin" header, as demonstrated by a device.rsp?opt=user&cmd=list request that provides credentials within JSON…

WHY THIS VERDICT Attack attempts are confirmed, with no confirmed exploitation yet.

WHY IT RANKS HERE Ready-made attack tools are public. The first report is 19 days old.

HIGHEST CONFIRMED RUNG
TRIED
CISA KEV
NOT YET
EXPLOIT CODE
READY TO USE
// EVIDENCE LADDER

How far has it climbed?

CONFIRMED
REPORTED
NO EVIDENCE

  1. 01 TALK

    □ NO EVIDENCE YET
    NEWEST EVIDENCE NONE YET

    No evidence yet.

    SRC: NONE YET

  2. 02 EXPOSED

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    We have no source that counts exposed systems yet. Internet scan data needs a partnership we do not have. No evidence here does not mean nothing is exposed.

  3. 03 TRIED

    ■ CONFIRMED
    NEWEST EVIDENCE · 1 SOURCE

    Attack attempts on CVE-2018-9995 seen by honeypots (Shadowserver via CIRCL).

  4. 04 EXPLOITED

    □ NO EVIDENCE YET
    NEWEST EVIDENCE NONE YET

    No evidence yet.

    SRC: NONE YET

  5. 05 DAMAGE

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    Breach notices and filings rarely name the flaw that was used, so we cannot link them to this event yet. No evidence here does not mean no harm.

// THE CLOCK

When each thing happened

  1. DISCLOSED
    CVE-2018-9995 published
  2. EXPLOIT CODE PUBLIC
    Exploit-DB
  3. FIRST ATTACK REPORT
    CIRCL Vulnerability-Lookup sightings
  4. CISA KEV LISTING
    NOT YET
  5. US FEDERAL DEADLINE
    NOT YET
Attacks were reported 3118 days after disclosure.
// TIMELINE · PACIFIC TIME

How it unfolded

  1. APR 29, 2018
    26 public GitHub repositories claim a proof of concept for CVE-2018-9995
  2. MAY 1, 2018
    Exploit-DB entry: TBK DVR4104 / DVR4216 - Credentials Leak
  3. Attack activity. OCT 22, 2026
    Attack attempts on CVE-2018-9995 seen by honeypots (Shadowserver via CIRCL)

SOURCES

  1. [1] nuclei-templates: Nuclei scan template: TBK DVR4104/DVR4216 Devices - Authentication Bypass, OCT 24
  2. [2] CIRCL Vulnerability-Lookup sightings: Attack attempts on CVE-2018-9995 seen by honeypots (Shadowserver via CIRCL), OCT 22
  3. [3] Exploit-DB: Exploit-DB entry: TBK DVR4104 / DVR4216 - Credentials Leak, MAY 1
  4. [4] PoC-in-GitHub: 26 public GitHub repositories claim a proof of concept for CVE-2018-9995, APR 29