CVE-2018-9995
TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus,...
TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login, which run re-branded versions of the original TBK DVR4104 and DVR4216 series, allow remote attackers to bypass authentication via a "Cookie: uid=admin" header, as demonstrated by a device.rsp?opt=user&cmd=list request that provides credentials within JSON data in a response.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login, which run re-branded versions of the original TBK DVR4104 and DVR4216 series, allow remote attackers to bypass authentication via a "Cookie: uid=admin" header, as demonstrated by a device.rsp?opt=user&cmd=list request that provides credentials within JSON data in a response.
- Record
CVE-2018-9995- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login, which run re-branded versions of the original TBK DVR4104 and DVR4216 series, allow remote attackers to bypass authentication via a "Cookie: uid=admin" header, as demonstrated by a device.rsp?opt=user&cmd=list request that provides credentials within JSON data in a response.
- Record
CVE-2018-9995- Updated
- 2026-11-02
EUVDEUVD-2018-21587 No score
TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login, which run re-branded versions of the original TBK DVR4104 and DVR4216 series, allow remote attackers to bypass authentication via a "Cookie: uid=admin" header, as demonstrated by a device.rsp?opt=user&cmd=list request that provides credentials within JSON data in a response.
- Record
EUVD-2018-21587- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mjcj-jjh8-28r2
TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus,...
TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login, which run re-branded versions of the original TBK DVR4104 and DVR4216 series, allow remote attackers to bypass authentication via a "Cookie: uid=admin" header, as demonstrated by a device.rsp?opt=user&cmd=list request that provides credentials within JSON data in a response.
- Record
GHSA-mjcj-jjh8-28r2- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | ezelf/CVE-2018-9995_dvr_credentials | 2018-04-29 |
| Exploit-DB | TBK DVR4104 / DVR4216 - Credentials Leak | 2018-05-02 |
| PoC in GitHub | zzh217/CVE-2018-9995_Batch_scanning_exp | 2018-05-08 |
| PoC in GitHub | Huangkey/CVE-2018-9995_check | 2018-05-09 |
| PoC in GitHub | gwolfs/CVE-2018-9995-ModifiedByGwolfs | 2018-05-11 |
| PoC in GitHub | Cyb0r9/DVR-Exploiter | 2018-09-23 |
| PoC in GitHub | mesutozsoycom/cve-2018-9995 | 2019-01-10 |
| PoC in GitHub | codeholic2k18/CVE-2018-9995 | 2019-01-28 |
| PoC in GitHub | TateYdq/CVE-2018-9995-ModifiedByGwolfs | 2019-04-20 |
| PoC in GitHub | ABIZCHI/CVE-2018-9995_dvr_credentials | 2019-05-28 |
Show 17 moreShow less
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | MrAli-Code/CVE-2018-9995_dvr_credentials | 2019-06-16 |
| PoC in GitHub | likaifeng0/CVE-2018-9995_dvr_credentials-dev_tool | 2019-09-05 |
| PoC in GitHub | b510/CVE-2018-9995-POC | 2019-12-16 |
| PoC in GitHub | wmasday/HTC | 2020-02-15 |
| PoC in GitHub | awesome-consumer-iot/HTC | 2021-03-25 |
| PoC in GitHub | Saeed22487/CVE-2018-9995 | 2021-03-30 |
| PoC in GitHub | kienquoc102/CVE-2018-9995-2 | 2021-06-07 |
| PoC in GitHub | dearpan/cve-2018-9995 | 2021-12-02 |
| PoC in GitHub | LeQuocKhanh2K/Tool_Exploit_Password_Camera_CVE-2018-9995 | 2022-02-18 |
| PoC in GitHub | ST0PL/DVRFaultNET | 2023-01-09 |
| PoC in GitHub | arminarab1999/CVE-2018-9995 | 2024-02-09 |
| PoC in GitHub | X3RX3SSec/DVR_Sploit | 2024-02-18 |
| PoC in GitHub | batmoshka55/CVE-2018-9995_dvr_credentials | 2024-05-09 |
| PoC in GitHub | dego905/Cam | 2024-05-21 |
| PoC in GitHub | A-Alabdoo/CVE-DVr | 2024-06-24 |
| PoC in GitHub | 0xDamian/CVE-2018-9995-rs | 2025-10-28 |
| Nuclei | TBK DVR4104/DVR4216 Devices - Authentication Bypass |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploits, exploits_more | ||
| exploits | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Nuclei, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-9995 is a critical vulnerability (CVSS 9.8) in Tbkvision Tbk-dvr4104 Firmware, published April 10, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 82.3%, the 99th percentile. No source names a fixed version.
References
bleepingcomputer.com/news/security/new-hacking-tool-lets-users-access-a-bunch-of-dvrs-and-their-video-feeds
exploit-db.com/exploits/44577
misteralfa-hack.blogspot.cl/2018/04/tbk-vision-dvr-login-bypass.html
nvd.nist.gov/vuln/detail/CVE-2018-9995
github.com/advisories/GHSA-mjcj-jjh8-28r2
The full exploit list has 1 more link.