CVE-2024-3721
moderate-risk
Published 2024-04-13
A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical. This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___. The manipulation of the argument mdb/mdc leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260573 was assigned to this vulnerability.
Do I need to act?
!
83.9% chance of exploitation in next 30 days
EPSS score — higher than 16% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.3/10
Medium
NETWORK
/ LOW complexity
References (8)
48
/ 100
moderate-risk
Severity
23/34 · High
Exploitability
20/34 · Moderate
Exposure
5/34 · Minimal