HVR - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/hvr/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 31 Oct 2026 00:04:46 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgTbkvision and various DVRs: Unauthenticated credential disclosure (CVE-2018-9995)https://feed.craftedsignal.io/briefs/2026-10-cve-2018-9995/Sat, 31 Oct 2026 00:04:46 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-cve-2018-9995/An unauthenticated credential disclosure vulnerability in various DVR devices allows attackers to retrieve administrative credentials via the /device.rsp endpoint.CVE-2018-9995 allows an unauthenticated attacker to retrieve administrative credentials from vulnerable digital video recorders (DVRs), hybrid video recorders (HVRs), and mobile digital video recorders (MDVRs). The vulnerability exists within the device web interface, specifically on the '/device.rsp' endpoint. By issuing a crafted HTTP request with specific parameters, an attacker can enumerate all configured users and their corresponding credentials.

Impact

Successful exploitation allows unauthorized parties to gain administrative access to affected video surveillance systems, potentially leading to unauthorized camera access, device control, and network pivoting.

Recommendation

  • Inventory and identify all internet-facing DVR, HVR, and MDVR devices in the environment.
  • Implement network segmentation to ensure these legacy devices are not directly accessible from the public internet.
  • Apply network-level access control lists (ACLs) to restrict access to the web interface to authorized management subnets only.
  • Monitor web server or WAF logs for requests targeting '/device.rsp' with 'opt=user' and 'cmd=list' parameters.
]]>highadvisorycredential-disclosurecve-2018-9995dvriot