SECURITY_THREAT_PULSE
LIVE
LAST UPDATED
FIRST SEEN
3 SOURCES ON THIS EVENT
◆ WATCHCVE-2024-3721 · CVSS 6.3

TBK DVR-4104: attackers can run commands on it

AFFECTSTBK DVR-4104Tbk Dvr-4216

OFFICIAL NAME: TBK DVR-4104/DVR-4216 os command injection

WHAT IT IS · ROUTERS, CAMERAS AND DEVICESRouters, cameras and recorders are often forgotten and rarely updated.

DO THIS FIRSTUpdate it or replace it. Never leave its admin page open to the internet. Not sure if you use it? Send this page to your IT provider or security lead and ask.

TECHNICAL SUMMARY A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical. This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___. The manipulation of the argument mdb/mdc leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

WHY THIS VERDICT Attacks are reported but not confirmed by an authoritative source, and the vulnerability is more than 90 days old.

WHY IT RANKS HERE Exploitation is reported. The first report is 19 days old.

HIGHEST CONFIRMED RUNG
TRIED
CISA KEV
NOT YET
EXPLOIT CODE
PROOF OF CONCEPT
// EVIDENCE LADDER

How far has it climbed?

CONFIRMED
REPORTED
NO EVIDENCE

  1. 01 TALK

    □ NO EVIDENCE YET
    NEWEST EVIDENCE NONE YET

    No evidence yet.

    SRC: NONE YET

  2. 02 EXPOSED

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    We have no source that counts exposed systems yet. Internet scan data needs a partnership we do not have. No evidence here does not mean nothing is exposed.

  3. 03 TRIED

    ■ CONFIRMED
    NEWEST EVIDENCE · 1 SOURCE

    Attack attempts on CVE-2024-3721 seen by honeypots (Shadowserver via CIRCL).

  4. 04 EXPLOITED

    ▨ REPORTED, NOT CONFIRMED
    NEWEST EVIDENCE · 1 SOURCE

    Exploitation of CVE-2024-3721 reported (CIRCL sighting).

  5. 05 DAMAGE

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    Breach notices and filings rarely name the flaw that was used, so we cannot link them to this event yet. No evidence here does not mean no harm.

// THE CLOCK

When each thing happened

  1. DISCLOSED
    CVE-2024-3721 published
  2. EXPLOIT CODE PUBLIC
    DATE UNKNOWN
  3. FIRST ATTACK REPORT
    CIRCL Vulnerability-Lookup sightings
  4. CISA KEV LISTING
    NOT YET
  5. US FEDERAL DEADLINE
    NOT YET
Attacks were reported 923 days after disclosure.
// ASK YOUR TEAM

Questions to ask this week

// TIMELINE · PACIFIC TIME

How it unfolded

  1. APR 13, 2024
    CISA Vulnrichment notes a public proof of concept for CVE-2024-3721
  2. Attack activity. OCT 22, 2026
    Attack attempts on CVE-2024-3721 seen by honeypots (Shadowserver via CIRCL)
  3. Attack activity. NOV 7, 2026
    Exploitation of CVE-2024-3721 reported (CIRCL sighting)

SOURCES

  1. [1] CIRCL Vulnerability-Lookup sightings: Exploitation of CVE-2024-3721 reported (CIRCL sighting), NOV 7
  2. [2] CIRCL Vulnerability-Lookup sightings: Attack attempts on CVE-2024-3721 seen by honeypots (Shadowserver via CIRCL), OCT 22
  3. [3] CVE List V5 and CISA Vulnrichment: CISA Vulnrichment notes a public proof of concept for CVE-2024-3721, APR 13