CrowdSecLive Exploit Tracker
Limited ExploitationCVE-2024-3721Public Exploit

DVR-4216 - RCE (CVE-2024-3721)

PublishedApr 13, 2024
First SeenMay 12, 2025
Last Seen
Reported
CVSS6.3
T
TBKDVR-4216
iot

Description

A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical. This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=S_O_S_T_R_E_A_MAX. The manipulation of the argument mdb/mdc leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260573 was assigned to this vulnerability.

psychologyCrowdSec Analysis

CVE-2024-3721 is a vulnerability found in certain TBK DVR devices that can allow remote attackers to perform OS command injection via crafted requests to a device management endpoint.

CrowdSec has been tracking this vulnerability and its exploits since 7th of May 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2024-3721 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Observed attack attempts typically involve requests to URLs containing /device.rsp with particular command parameters.

lock

Full Intelligence Available

Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.

EventDate
CVE Published2024-04-13
Rule Released2025-05-07
CrowdSec First Seen2025-05-12

Related Weaknesses

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

arrow_forward

Remediation & Protection

lock to download blocklists, subscribe to firewalls, and access IP intelligence.

External References