TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login, which run re-branded versions of the original TBK DVR4104 and DVR4216 series, allow remote attackers to bypass authentication via a "Cookie: uid=admin" header, as demonstrated by a device.rsp?opt=user&cmd=list request that provides credentials within JSON data in a response.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2018-04-10T22:00:00
Updated: 2024-08-05T07:32:01.171Z
Reserved: 2018-04-10T00:00:00
Link: CVE-2018-9995
Vulnrichment
No data.
NVD
Status : Modified
Published: 2018-04-10T22:29:00.290
Modified: 2024-11-21T04:16:00.300
Link: CVE-2018-9995
Redhat
No data.