Threat actors are taking advantage of an unpatched five-year-old flaw in TBK digital video recording (DVR) devices. The vulnerability, known as CVE-2018-9995, is a critical authentication bypass issue that malicious actors can exploit to gain elevated permissions remotely. Despite the availability of a PoC exploit, there are no fixes that address the vulnerability.
CVE-2018-9995 vulnerability affecting TBK DVR devices
The CVE-2018-9995 vulnerability affecting TBK DVR devices is a critical authentication bypass issue that can allow an unauthorized user to access the device. This vulnerability could eventually lead to an attacker gaining elevated permissions, allowing them to execute arbitrary operating system commands. The CVSS score for this vulnerability is 9.8 out of 10, indicating the severity level assigned to it.
Fortinet Observation
According to Fortinet Labs, there has been an increase in efforts to exploit TBK DVR devices utilizing the CVE-2018-9995 vulnerability. In April 2021, Fortinet recognized over 50,000 attempts to exploit these devices. The increased exploitation indicates that the vulnerability could be used as a vector to intrude into a trusted network.
Absence of Fixes for the CVE-2018-9995 Vulnerability
Despite a proof-of-concept (PoC) exploit being available, no fixes have been proposed to address the CVE-2018-9995 vulnerability. As a result, attackers can take advantage of the vulnerability to exploit TBK DVR devices.
Affected product lines and rebranded products
The CVE-2018-9995 vulnerability affects the TBK DVR4104 and DVR4216 product lines. However, some rebranded products purchased under different brand names are also impacted by this flaw.
CVE-2016-20016 vulnerability affecting MVPower CCTV DVR models
Fortinet also warned of a surge in exploitation of CVE-2016-20016, which affects MVPower CCTV DVR models. This critical vulnerability could be exploited by remotely unauthenticated attackers to execute arbitrary operating system commands as root because of the presence of a web shell that is accessible over a /shell URI.
Attractiveness of the CVE-2018-9995 Vulnerability to Attackers
The vulnerability in TBK DVR devices is an easy target for attackers. There is publicly available proof-of-concept code that attackers can use, and the vulnerability is easy to exploit. With tens of thousands of TBK DVRs available under different brands, the CVE-2018-9995 vulnerability is a tempting target for malicious actors.
The Popularity of Network Camera Devices as a Target for Attackers
The recent spike in IPS detections indicates that network camera devices remain popular targets for attackers. The vulnerability CVE-2018-9995 demonstrates that there is a continued need for upgrades and patches to strengthen the security of IoT devices.
Fortinet issued an outbreak alert on May 1, 2023, warning about the ongoing exploitation of vulnerable TBK DVR devices. The report emphasizes the need for quick action to confront the vulnerabilities demonstrated in IoT security threats.
The continued exploitation of the CVE-2018-9995 vulnerability affecting TBK DVR devices is a cause for concern. The lack of fixes or solutions for this vulnerability may expose organizations to attacks that could lead to severe data breaches. This alert is a reminder for users to adopt standard security measures, such as updating firmware, and preventing unauthorized access to their network. Organizations that employ IoT devices or DVRs should regularly update their systems, continuously scan their environment, and implement strict security protocols.
