{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/xvr/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:h:tbkvision:tbk-dvr4216:*:*:*:*:*:*:*:*","cpe:2.3:o:tbkvision:tbk-dvr4216_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:tbkvision:tbk-dvr4104_firmware:-:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2018-9995"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["tbk-dvr4216 (All versions)","DVR","HVR","MDVR","XVR"],"_cs_severities":["high"],"_cs_tags":["credential-disclosure","cve-2018-9995","dvr","iot"],"_cs_type":"advisory","_cs_vendors":["Tbkvision","Cenova","Night Owl","Pulnix","Qsee","Securus"],"content_html":"\u003cp\u003eCVE-2018-9995 allows an unauthenticated attacker to retrieve administrative credentials from vulnerable digital video recorders (DVRs), hybrid video recorders (HVRs), and mobile digital video recorders (MDVRs). The vulnerability exists within the device web interface, specifically on the '/device.rsp' endpoint. By issuing a crafted HTTP request with specific parameters, an attacker can enumerate all configured users and their corresponding credentials.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthorized parties to gain administrative access to affected video surveillance systems, potentially leading to unauthorized camera access, device control, and network pivoting.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory and identify all internet-facing DVR, HVR, and MDVR devices in the environment.\u003c/li\u003e\n\u003cli\u003eImplement network segmentation to ensure these legacy devices are not directly accessible from the public internet.\u003c/li\u003e\n\u003cli\u003eApply network-level access control lists (ACLs) to restrict access to the web interface to authorized management subnets only.\u003c/li\u003e\n\u003cli\u003eMonitor web server or WAF logs for requests targeting '/device.rsp' with 'opt=user' and 'cmd=list' parameters.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-31T00:04:46Z","date_published":"2026-10-31T00:04:46Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2018-9995/","summary":"An unauthenticated credential disclosure vulnerability in various DVR devices allows attackers to retrieve administrative credentials via the /device.rsp endpoint.","title":"Tbkvision and various DVRs: Unauthenticated credential disclosure (CVE-2018-9995)","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2018-9995/"}],"language":"en","title":"CraftedSignal Threat Feed - XVR","version":"https://jsonfeed.org/version/1.1"}