Unpatched Five-Year-Old Flaw in TBK DVR Devices Actively Exploited by Threat Actors

May 3, 2023

Unpatched Five-Year-Old Flaw in TBK DVR Devices Actively Exploited by Threat Actors

Threat actors are taking advantage of an unpatched five-year-old flaw in TBK digital video recording (DVR) devices. The vulnerability, known as CVE-2018-9995, is a critical authentication bypass issue that malicious actors can exploit to gain elevated permissions remotely. Despite the availability of a PoC exploit, there are no fixes that address the vulnerability.

CVE-2018-9995 vulnerability affecting TBK DVR devices

The CVE-2018-9995 vulnerability affecting TBK DVR devices is a critical authentication bypass issue that can allow an unauthorized user to access the device. This vulnerability could eventually lead to an attacker gaining elevated permissions, allowing them to execute arbitrary operating system commands. The CVSS score for this vulnerability is 9.8 out of 10, indicating the severity level assigned to it.

Fortinet Observation

According to Fortinet Labs, there has been an increase in efforts to exploit TBK DVR devices utilizing the CVE-2018-9995 vulnerability. In April 2021, Fortinet recognized over 50,000 attempts to exploit these devices. The increased exploitation indicates that the vulnerability could be used as a vector to intrude into a trusted network.

Absence of Fixes for the CVE-2018-9995 Vulnerability

Despite a proof-of-concept (PoC) exploit being available, no fixes have been proposed to address the CVE-2018-9995 vulnerability. As a result, attackers can take advantage of the vulnerability to exploit TBK DVR devices.

Affected product lines and rebranded products

The CVE-2018-9995 vulnerability affects the TBK DVR4104 and DVR4216 product lines. However, some rebranded products purchased under different brand names are also impacted by this flaw.

CVE-2016-20016 vulnerability affecting MVPower CCTV DVR models

Fortinet also warned of a surge in exploitation of CVE-2016-20016, which affects MVPower CCTV DVR models. This critical vulnerability could be exploited by remotely unauthenticated attackers to execute arbitrary operating system commands as root because of the presence of a web shell that is accessible over a /shell URI.

Attractiveness of the CVE-2018-9995 Vulnerability to Attackers

The vulnerability in TBK DVR devices is an easy target for attackers. There is publicly available proof-of-concept code that attackers can use, and the vulnerability is easy to exploit. With tens of thousands of TBK DVRs available under different brands, the CVE-2018-9995 vulnerability is a tempting target for malicious actors.

The Popularity of Network Camera Devices as a Target for Attackers

The recent spike in IPS detections indicates that network camera devices remain popular targets for attackers. The vulnerability CVE-2018-9995 demonstrates that there is a continued need for upgrades and patches to strengthen the security of IoT devices.

Fortinet issued an outbreak alert on May 1, 2023, warning about the ongoing exploitation of vulnerable TBK DVR devices. The report emphasizes the need for quick action to confront the vulnerabilities demonstrated in IoT security threats.

The continued exploitation of the CVE-2018-9995 vulnerability affecting TBK DVR devices is a cause for concern. The lack of fixes or solutions for this vulnerability may expose organizations to attacks that could lead to severe data breaches. This alert is a reminder for users to adopt standard security measures, such as updating firmware, and preventing unauthorized access to their network. Organizations that employ IoT devices or DVRs should regularly update their systems, continuously scan their environment, and implement strict security protocols.

Explore more

Is Desktop Customization the Cure for Linux Distro Hopping?

July 31, 2026

The rapid advancement of personal computing technology often creates a paradox where perfectly functional hardware is rendered obsolete by the arbitrary software constraints of major operating system vendors. Many users find themselves in a position where reliable machines, still possessing significant processing power and memory capacity, are suddenly excluded from receiving the latest security updates or feature sets. This forced

North Korean Hackers Use Fake macOS Updates to Steal Crypto

July 31, 2026

The sophisticated digital landscape of 2026 has witnessed a dramatic surge in highly targeted cyberattacks that specifically exploit the perceived inherent security of Apple’s macOS ecosystem. While many users once believed that the Unix-based architecture and rigorous app-vetting processes provided an impenetrable shield, state-sponsored actors from North Korea have proven otherwise by deploying deceptive software updates. These campaigns often leverage

Microsoft Copilot Flaw Enables Self-Propagating AI Worms

July 31, 2026

The rapid deployment of artificial intelligence within the corporate workspace has traditionally been viewed as a productivity catalyst, yet recent security discoveries have unveiled a sophisticated threat that fundamentally challenges the safety of automated workflows. Security researchers have identified a critical vulnerability within Microsoft Copilot for Word that facilitates a new class of “prompt injection” attacks, allowing malicious actors to

Is Your B2B PR Strategy Building Credibility or Just Noise?

July 31, 2026

Waiting until a major funding round or a massive product launch to initiate a public relations strategy often leaves B2B startups in a precarious position of anonymity during their most critical growth phases. Many founders operate under the misconception that public relations is a reactive mechanism, a lever to be pulled only when there is substantial news to share with

How Can B2B Brands Break Through Digital Marketing Fatigue?

July 31, 2026

The modern B2B procurement environment has transitioned into a hyper-saturated ecosystem where senior decision-makers are currently bombarded by a relentless stream of algorithmically generated outreach and automated marketing sequences. This pervasive digital marketing fatigue has rendered traditional tactics, such as high-volume email sequences and generic personalization tokens, largely ineffective for capturing the attention of high-value prospects who have grown cynical