Unpatched Five-Year-Old Flaw in TBK DVR Devices Actively Exploited by Threat Actors

May 3, 2023

Unpatched Five-Year-Old Flaw in TBK DVR Devices Actively Exploited by Threat Actors

Threat actors are taking advantage of an unpatched five-year-old flaw in TBK digital video recording (DVR) devices. The vulnerability, known as CVE-2018-9995, is a critical authentication bypass issue that malicious actors can exploit to gain elevated permissions remotely. Despite the availability of a PoC exploit, there are no fixes that address the vulnerability.

CVE-2018-9995 vulnerability affecting TBK DVR devices

The CVE-2018-9995 vulnerability affecting TBK DVR devices is a critical authentication bypass issue that can allow an unauthorized user to access the device. This vulnerability could eventually lead to an attacker gaining elevated permissions, allowing them to execute arbitrary operating system commands. The CVSS score for this vulnerability is 9.8 out of 10, indicating the severity level assigned to it.

Fortinet Observation

According to Fortinet Labs, there has been an increase in efforts to exploit TBK DVR devices utilizing the CVE-2018-9995 vulnerability. In April 2021, Fortinet recognized over 50,000 attempts to exploit these devices. The increased exploitation indicates that the vulnerability could be used as a vector to intrude into a trusted network.

Absence of Fixes for the CVE-2018-9995 Vulnerability

Despite a proof-of-concept (PoC) exploit being available, no fixes have been proposed to address the CVE-2018-9995 vulnerability. As a result, attackers can take advantage of the vulnerability to exploit TBK DVR devices.

Affected product lines and rebranded products

The CVE-2018-9995 vulnerability affects the TBK DVR4104 and DVR4216 product lines. However, some rebranded products purchased under different brand names are also impacted by this flaw.

CVE-2016-20016 vulnerability affecting MVPower CCTV DVR models

Fortinet also warned of a surge in exploitation of CVE-2016-20016, which affects MVPower CCTV DVR models. This critical vulnerability could be exploited by remotely unauthenticated attackers to execute arbitrary operating system commands as root because of the presence of a web shell that is accessible over a /shell URI.

Attractiveness of the CVE-2018-9995 Vulnerability to Attackers

The vulnerability in TBK DVR devices is an easy target for attackers. There is publicly available proof-of-concept code that attackers can use, and the vulnerability is easy to exploit. With tens of thousands of TBK DVRs available under different brands, the CVE-2018-9995 vulnerability is a tempting target for malicious actors.

The Popularity of Network Camera Devices as a Target for Attackers

The recent spike in IPS detections indicates that network camera devices remain popular targets for attackers. The vulnerability CVE-2018-9995 demonstrates that there is a continued need for upgrades and patches to strengthen the security of IoT devices.

Fortinet issued an outbreak alert on May 1, 2023, warning about the ongoing exploitation of vulnerable TBK DVR devices. The report emphasizes the need for quick action to confront the vulnerabilities demonstrated in IoT security threats.

The continued exploitation of the CVE-2018-9995 vulnerability affecting TBK DVR devices is a cause for concern. The lack of fixes or solutions for this vulnerability may expose organizations to attacks that could lead to severe data breaches. This alert is a reminder for users to adopt standard security measures, such as updating firmware, and preventing unauthorized access to their network. Organizations that employ IoT devices or DVRs should regularly update their systems, continuously scan their environment, and implement strict security protocols.

Explore more

Global RPA Market Set for Rapid Growth Through 2033

March 2, 2026

The modern business environment has reached a definitive turning point where the distinction between human administrative effort and automated digital execution is blurring into a singular, cohesive workflow. As organizations navigate the complexities of a post-pandemic economic landscape in 2026, the reliance on Robotic Process Automation (RPA) has transitioned from a competitive advantage to a fundamental requirement for survival. This

US Labor Market Cools Following January Employment Surge

March 2, 2026

The sheer magnitude of the employment surge witnessed during the first month of the year has left economists questioning whether the American economy is truly overheating or simply experiencing a statistical anomaly. While January provided a blowout performance that defied most conservative forecasts, the subsequent data for February suggests that a significant cooling period is finally taking hold. This shift

Trend Analysis: Entry Level Remote Careers

March 2, 2026

The long-standing belief that securing a high-paying professional career requires a decade of office-bound grinding is being systematically dismantled by a digital-first economy that values specific output over physical attendance. For decades, the entry-level designation often implied a physical presence in a cubicle and years of preparatory internships, yet fresh data suggests that high-paying remote opportunities are now accessible to

How to Bridge Skills Gaps by Developing Internal Talent

March 2, 2026

The modern labor market presents a paradoxical challenge where specialized roles remain vacant for months while thousands of capable employees feel their professional growth has hit an impenetrable ceiling. This misalignment is not merely a recruitment issue but a systemic failure to recognize “adjacent-fit” talent—individuals who already possess the vast majority of required competencies but are overlooked due to rigid

Is Physical Disability a Barrier to Executive Leadership?

March 2, 2026

When a seasoned diplomat with a career spanning the United Nations and high-level corporate strategy enters a boardroom, the initial assessment by peers should theoretically rest upon a decade of proven crisis management and multi-million-dollar partnership successes. However, for many leaders who live with visible physical disabilities, the resume often faces an uphill battle against a deeply ingrained societal bias.