CVE-2024-3721
MEDIUM EXPLOITEDTBK DVR-4104/4216 <20240412 - Command Injection
Title source: llmExploitation Summary
CVE-2024-3721 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 2 public exploits from researchers including bytecategory, qalvynn.
AI-analyzed exploit summary This repository provides a functional exploit for CVE-2024-3721, demonstrating how to achieve remote code execution (RCE) on a vulnerable system by leveraging a command injection vulnerability. The exploit involves downloading and executing malicious binaries (tinyproxy and a DDoS tool) on the target system.
Description
A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical. This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___. The manipulation of the argument mdb/mdc leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260573 was assigned to this vulnerability.
Exploits (2)
This repository provides a functional exploit for CVE-2024-3721, demonstrating how to achieve remote code execution (RCE) on a vulnerable system by leveraging a command injection vulnerability. The exploit involves downloading and executing malicious binaries (tinyproxy and a DDoS tool) on the target system.
This is a functional exploit PoC for CVE-2024-3721, targeting a command injection vulnerability in a web server via a crafted HTTP POST request. The code establishes multiple TCP connections to random IPs, sends a malicious payload to execute arbitrary commands, and downloads/executes a secondary payload ('arm7').
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L