Skip to content
Threat Feed
Subscribe
high advisory

Tbkvision and various DVRs: Unauthenticated credential disclosure (CVE-2018-9995)

An unauthenticated credential disclosure vulnerability in various DVR devices allows attackers to retrieve administrative credentials via the /device.rsp endpoint.

CVE search metadata

CVE search record: CVE-2018-9995. Severity: critical. CVSS: 9.8. EPSS: 82.32%. KEV: no. Product: tbk-dvr4216 (All versions), DVR, HVR, MDVR, XVR. Brief: Tbkvision and various DVRs: Unauthenticated credential disclosure (CVE-2018-9995). Brief link: https://feed.craftedsignal.io/briefs/2026-10-cve-2018-9995/

Triage facts

Revision 1
Applicability
tbk-dvr4216 (All versions), DVR +3
Evidence
Unknown
Severity
High
Action
Elevated
Sources
2 public sources
Freshness
Revision 1Oct 31, 00:04 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
B2Likely

CVE-2018-9995 allows an unauthenticated attacker to retrieve administrative credentials from vulnerable digital video recorders (DVRs), hybrid video recorders (HVRs), and mobile digital video recorders (MDVRs). The vulnerability exists within the device web interface, specifically on the '/device.rsp' endpoint. By issuing a crafted HTTP request with specific parameters, an attacker can enumerate all configured users and their corresponding credentials.

Impact

Successful exploitation allows unauthorized parties to gain administrative access to affected video surveillance systems, potentially leading to unauthorized camera access, device control, and network pivoting.

Recommendation

  • Inventory and identify all internet-facing DVR, HVR, and MDVR devices in the environment.
  • Implement network segmentation to ensure these legacy devices are not directly accessible from the public internet.
  • Apply network-level access control lists (ACLs) to restrict access to the web interface to authorized management subnets only.
  • Monitor web server or WAF logs for requests targeting '/device.rsp' with 'opt=user' and 'cmd=list' parameters.

Immediate actions

Scan network perimeter for internet-exposed DVR interfaces

SOC 24h

Mitigations

Place vulnerable DVR/HVR devices behind a VPN or firewall ACL

immediate IT Operations

CVE-2018-9995

Detection coverage 1

Detect CVE-2018-9995 Exploitation Attempt

high

Detects unauthenticated credential disclosure attempts by monitoring for requests to /device.rsp with user enumeration parameters

sigma tactics: credential_access techniques: T1592 sources: webserver

Detection queries are available on the platform. Get full rules →