CVE-2024-3721

Think of this like a security guard's control panel that can be tricked into running any command just by sending it a crafted message — no password needed to abuse the trick once you have low-level access. For a business, that means the camera system meant to protect you could instead become the attacker's way in, exposing footage or giving them a foothold on your network.

This matters to you if you run a TBK DVR-4104 or DVR-4216 video recorder, commonly used for CCTV/security camera systems (sometimes sold under other brand names). The real risk only applies if the device is reachable from the internet or an attacker already has some low-level access to it.

Attackers already have a working public exploit for this flaw, and security researchers report sustained attention due to active exploitation — this is not a theoretical risk. Because there's no official patch, exposed devices should be isolated from the internet now, not after a fix becomes available.

Confirm model and firmware version (affected: DVR-4104 and DVR-4216 up to build 20240412). Check whether the device's web/HTTP management interface — specifically the /device.rsp?opt=sys&cmd=S_O_S_T_R_E_A_MAX endpoint — is reachable from outside your network (internet scan or external port check). There is currently no vendor-supplied version fix; the only documented remediation is network-level: place the device behind a firewall, disable any port-forwarding/UPnP that exposes it externally, and restrict access to trusted internal subnets or a VPN. Treat any device with low-privilege remote access as fully compromised if internet-exposed, since the CVSS vector requires only low privileges and no user interaction. Monitor for unexpected outbound connections or new processes/services on the DVR, and watch vendor/reseller channels for a firmware update. Not listed in CISA KEV at this time, so there is no mandated federal remediation deadline, but public PoC availability plus sustained press attention warrant immediate compensating controls.

CVSS 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) — CWE-78 OS command injection via unsanitized mdb/mdc parameters passed to the system command handler. Exploit maturity: public PoC exists on GitHub; EPSS predicts very high likelihood of exploitation activity (percentile at the extreme top end), consistent with sustained press attention attributing activity to exploitation. Not currently in CISA KEV. No vendor-issued patched firmware version identified; vendor guidance limited to compensating network controls (firewalling remote access).