© 2026 vulntracker.io

CVE-2018-9995

N/A

Published: April 10, 2018 at 10:00 PM UTC

Updated: June 17, 2026 at 02:07 AM UTC

4 products affected across 1 vendorTbk DVR4104 FirmwareTbk DVR4216 FirmwareTbk DVR4104

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

N/A

Exploit prediction

EPSS 82%

Description

TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login, which run re-branded versions of the original TBK DVR4104 and DVR4216 series, allow remote attackers to bypass authentication via a "Cookie: uid=admin" header, as demonstrated by a device.rsp?opt=user&cmd=list request that provides credentials within JSON data in a response.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Tbk DVR4104 Firmware · Tbkvision

95%

All versions

tbkvision-tbk-dvr4104 (same device)

Tbk DVR4216 Firmware · Tbkvision

95%

All versions

tbkvision-tbk-dvr4216 (same device)

Tbk DVR4104 · Tbkvisiondevice

80%

All versions

Tbk DVR4216 · Tbkvisiondevice

80%

All versions

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (4)

x_refsource_MISCExploitThird Party Advisory

Source: [email protected]

http://misteralfa-hack.blogspot.cl/2018/04/tbk-vision-dvr-login-bypass.html

x_refsource_MISCExploitThird Party Advisory

Source: [email protected]

http://misteralfa-hack.blogspot.cl/2018/04/update-dvr-login-bypass-cve-2018-9995.html

x_refsource_MISCExploitThird Party Advisory

Source: [email protected]

https://www.bleepingcomputer.com/news/security/new-hacking-tool-lets-users-access-a-bunch-of-dvrs-and-their-video-feeds/

Exploitx_refsource_EXPLOIT-DBThird Party AdvisoryVDB Entry

Source: [email protected]

https://www.exploit-db.com/exploits/44577/

CVSS

5MEDIUM[email protected]

Confidentiality: PARTIAL
Integrity: NONE
Availability: NONE

Vector?

Quick Info

StatusMODIFIED

CWE

NVD-CWE-noinfo

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card