CVE ID:

CVE-2018-9995

Details:

TBK DVR4104 and DVR4216 devices allow remote attackers to bypass authentication via a "Cookie: uid=admin" header, as demonstrated by a device.rsp?opt=user&cmd=list request that provides credentials within JSON data in a response.

References:

:http://misteralfa-hack.blogspot.cl/2018/04/tbk-vision-dvr-login-bypass.html

ZeroDayLab Assigned Tags:

BYPASS ACCESS CONTROL
REMOTE
SECURITY BYPASS