Cloudanix VulnDB

CVE-2018-9995

Critical · 9.8

CVSS

9.8

EPSS

82.3%

Published

Apr 10, 2018

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Attend

Older security camera recorders can be reached and controlled by anyone who knows a simple trick, letting outsiders watch or alter surveillance video without any password.

Weaponized
Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Trivial
Impact
Full Compromise
Component
Application
Class
Authentication Bypass
Remediation
No Fix Yet
Effort
Other
Patch risk
Other

What it actually does

Remote unauthenticated access to device management endpoints by supplying a Cookie header containing uid=admin, resulting in disclosure of administrative credentials in JSON responses from endpoints such as device.rsp.

Why it matters to the business

Exposure of physical surveillance infrastructure to remote attackers can enable live monitoring, tampering with recordings, or pivoting into connected networks, undermining site security and incident response capabilities.

How an attack unfolds

Attackers issue unauthenticated HTTP requests to exposed DVR endpoints while setting the uid=admin cookie; the device responds with JSON containing valid credentials, which are then reused to issue privileged commands. Public weaponized exploits have existed since disclosure, enabling mass scanning and compromise of internet-facing devices.

How to fix it

Replace affected TBK, Novo, CeNova, QSee, Pulnix, XVR, Securus, Night OWL, and related rebranded DVR units with current firmware or supported hardware; where replacement is impossible, enforce network segmentation, block inbound HTTP traffic from untrusted sources, and disable remote management.

How to confirm the fix worked

Test exposure by sending an HTTP GET to /device.rsp?opt=user&cmd=list with the header Cookie: uid=admin and confirming whether credentials are returned in the JSON body; verify that segmentation or replacement prevents such responses.

Typical attack path

  1. Discover exposed DVR HTTP interfaces via internet scanning
  2. Issue request to device.rsp or similar endpoints with Cookie: uid=admin
  3. Parse JSON response for admin credentials
  4. Authenticate with obtained credentials and issue control commands
  5. Establish persistence or move laterally into attached networks

How to detect it

Search web server or proxy logs for HTTP requests containing the literal string uid=admin in Cookie headers or targeting device.rsp endpoints; review firewall and IDS logs for connections from external addresses to the device management ports.

  • Cookie: uid=admin
  • device.rsp?opt=user&cmd=list
  • GET /device.rsp

What your security team should do

  • Immediately restrict internet exposure of all listed DVR models using firewall rules or VPN-only access
  • Inventory and prioritize replacement of end-of-life DVR hardware
  • Monitor perimeter logs for requests containing uid=admin or device.rsp paths
  • Disable remote web interfaces where operationally feasible

The record

TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login, which run re-branded versions of the original TBK DVR4104 and DVR4216 series, allow remote attackers to bypass authentication via a "Cookie: uid=admin" header, as demonstrated by a device.rsp?opt=user&cmd=list request that provides credentials within JSON data in a response.

Affected packages

Ecosystem Package Introduced Fixed