Cyber Resilience

CVE-2024-3721

Medium

Published: 13 April 2024

Published
13 April 2024
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.7675 99.0th percentile
Risk Priority 59 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-3721 is a medium-severity OS Command Injection (CWE-78) vulnerability. Its CVSS base score is 6.3 (Medium).

Operationally, ranked in the top 1.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

A vulnerability classified as critical was identified in TBK DVR-4104 and DVR-4216 devices up to version 20240412. It resides in the handling of the file /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___, where manipulation of the mdb or mdc argument permits OS command injection. The flaw is tracked as CWE-78 and received a CVSS 3.1 score of 6.3.

The issue can be exploited remotely by an authenticated attacker with low privileges and without user interaction, resulting in limited impacts to confidentiality, integrity, and availability. Public exploit code has been released that demonstrates the command injection.

The provided references consist of a public GitHub repository containing proof-of-concept code and several Vuldb entries; none of the references describe vendor patches, workarounds, or official mitigation guidance.

EPSS for the CVE reached a peak of 0.8542 and currently stands at 0.7675, indicating substantial and sustained exploitation interest after disclosure.

EU & UK References

Vulnerability details

A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical. This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___. The manipulation of the argument mdb/mdc leads to os command injection. The attack may…

more

be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260573 was assigned to this vulnerability.

CWE(s)
CWE-78

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-27 Platform-independent Applications
addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

SI-10 Information Input Validation
addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References