{"id":"CVE-2018-9995","aliases":["EUVD-2018-21587","GHSA-mjcj-jjh8-28r2"],"status":"published","title":"TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus,...","description":"TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login, which run re-branded versions of the original TBK DVR4104 and DVR4216 series, allow remote attackers to bypass authentication via a \"Cookie: uid=admin\" header, as demonstrated by a device.rsp?opt=user\u0026cmd=list request that provides credentials within JSON data in a response.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.82322,"percentile":0.99663,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"published":"2018-04-10T22:00:00Z","modified":"2026-06-17T02:07:27Z","exploits":[{"source":"pocgithub","id":"ezelf/CVE-2018-9995_dvr_credentials","title":"ezelf/CVE-2018-9995_dvr_credentials","date":"2018-04-29","url":"https://github.com/ezelf/CVE-2018-9995_dvr_credentials"},{"source":"exploitdb","id":"EDB-44577","title":"TBK DVR4104 / DVR4216 - Credentials Leak","type":"remote","platform":"hardware","date":"2018-05-02","url":"https://www.exploit-db.com/exploits/44577"},{"source":"pocgithub","id":"zzh217/CVE-2018-9995_Batch_scanning_exp","title":"zzh217/CVE-2018-9995_Batch_scanning_exp","date":"2018-05-08","url":"https://github.com/zzh217/CVE-2018-9995_Batch_scanning_exp"},{"source":"pocgithub","id":"Huangkey/CVE-2018-9995_check","title":"Huangkey/CVE-2018-9995_check","date":"2018-05-09","url":"https://github.com/Huangkey/CVE-2018-9995_check"},{"source":"pocgithub","id":"gwolfs/CVE-2018-9995-ModifiedByGwolfs","title":"gwolfs/CVE-2018-9995-ModifiedByGwolfs","date":"2018-05-11","url":"https://github.com/gwolfs/CVE-2018-9995-ModifiedByGwolfs"},{"source":"pocgithub","id":"Cyb0r9/DVR-Exploiter","title":"Cyb0r9/DVR-Exploiter","date":"2018-09-23","url":"https://github.com/Cyb0r9/DVR-Exploiter"},{"source":"pocgithub","id":"mesutozsoycom/cve-2018-9995","title":"mesutozsoycom/cve-2018-9995","date":"2019-01-10","url":"https://github.com/mesutozsoycom/cve-2018-9995"},{"source":"pocgithub","id":"codeholic2k18/CVE-2018-9995","title":"codeholic2k18/CVE-2018-9995","date":"2019-01-28","url":"https://github.com/codeholic2k18/CVE-2018-9995"},{"source":"pocgithub","id":"TateYdq/CVE-2018-9995-ModifiedByGwolfs","title":"TateYdq/CVE-2018-9995-ModifiedByGwolfs","date":"2019-04-20","url":"https://github.com/TateYdq/CVE-2018-9995-ModifiedByGwolfs"},{"source":"pocgithub","id":"ABIZCHI/CVE-2018-9995_dvr_credentials","title":"ABIZCHI/CVE-2018-9995_dvr_credentials","date":"2019-05-28","url":"https://github.com/ABIZCHI/CVE-2018-9995_dvr_credentials"},{"source":"pocgithub","id":"MrAli-Code/CVE-2018-9995_dvr_credentials","title":"MrAli-Code/CVE-2018-9995_dvr_credentials","date":"2019-06-16","url":"https://github.com/MrAli-Code/CVE-2018-9995_dvr_credentials"},{"source":"pocgithub","id":"likaifeng0/CVE-2018-9995_dvr_credentials-dev_tool","title":"likaifeng0/CVE-2018-9995_dvr_credentials-dev_tool","date":"2019-09-05","url":"https://github.com/likaifeng0/CVE-2018-9995_dvr_credentials-dev_tool"},{"source":"pocgithub","id":"b510/CVE-2018-9995-POC","title":"b510/CVE-2018-9995-POC","date":"2019-12-16","url":"https://github.com/b510/CVE-2018-9995-POC"},{"source":"pocgithub","id":"wmasday/HTC","title":"wmasday/HTC","date":"2020-02-15","url":"https://github.com/wmasday/HTC"},{"source":"pocgithub","id":"awesome-consumer-iot/HTC","title":"awesome-consumer-iot/HTC","date":"2021-03-25","url":"https://github.com/awesome-consumer-iot/HTC"},{"source":"pocgithub","id":"Saeed22487/CVE-2018-9995","title":"Saeed22487/CVE-2018-9995","date":"2021-03-30","url":"https://github.com/Saeed22487/CVE-2018-9995"},{"source":"pocgithub","id":"kienquoc102/CVE-2018-9995-2","title":"kienquoc102/CVE-2018-9995-2","date":"2021-06-07","url":"https://github.com/kienquoc102/CVE-2018-9995-2"},{"source":"pocgithub","id":"dearpan/cve-2018-9995","title":"dearpan/cve-2018-9995","date":"2021-12-02","url":"https://github.com/dearpan/cve-2018-9995"},{"source":"pocgithub","id":"LeQuocKhanh2K/Tool_Exploit_Password_Camera_CVE-2018-9995","title":"LeQuocKhanh2K/Tool_Exploit_Password_Camera_CVE-2018-9995","date":"2022-02-18","url":"https://github.com/LeQuocKhanh2K/Tool_Exploit_Password_Camera_CVE-2018-9995"},{"source":"pocgithub","id":"ST0PL/DVRFaultNET","title":"ST0PL/DVRFaultNET","date":"2023-01-09","url":"https://github.com/ST0PL/DVRFaultNET"},{"source":"pocgithub","id":"arminarab1999/CVE-2018-9995","title":"arminarab1999/CVE-2018-9995","date":"2024-02-09","url":"https://github.com/arminarab1999/CVE-2018-9995"},{"source":"pocgithub","id":"X3RX3SSec/DVR_Sploit","title":"X3RX3SSec/DVR_Sploit","date":"2024-02-18","url":"https://github.com/X3RX3SSec/DVR_Sploit"},{"source":"pocgithub","id":"batmoshka55/CVE-2018-9995_dvr_credentials","title":"batmoshka55/CVE-2018-9995_dvr_credentials","date":"2024-05-09","url":"https://github.com/batmoshka55/CVE-2018-9995_dvr_credentials"},{"source":"pocgithub","id":"dego905/Cam","title":"dego905/Cam","date":"2024-05-21","url":"https://github.com/dego905/Cam"},{"source":"pocgithub","id":"A-Alabdoo/CVE-DVr","title":"A-Alabdoo/CVE-DVr","date":"2024-06-24","url":"https://github.com/A-Alabdoo/CVE-DVr"},{"source":"pocgithub","id":"0xDamian/CVE-2018-9995-rs","title":"0xDamian/CVE-2018-9995-rs","date":"2025-10-28","url":"https://github.com/0xDamian/CVE-2018-9995-rs"},{"source":"nuclei","id":"CVE-2018-9995","title":"TBK DVR4104/DVR4216 Devices - Authentication Bypass","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-9995.yaml"}],"exploits_more":1,"products":[{"vendor":"tbkvision","product":"tbk-dvr4104_firmware"},{"vendor":"tbkvision","product":"tbk-dvr4216_firmware"}],"references":[{"url":"https://www.bleepingcomputer.com/news/security/new-hacking-tool-lets-users-access-a-bunch-of-dvrs-and-their-video-feeds/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/44577/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://misteralfa-hack.blogspot.cl/2018/04/tbk-vision-dvr-login-bypass.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"http://misteralfa-hack.blogspot.cl/2018/04/update-dvr-login-bypass-cve-2018-9995.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-9995"},{"url":"https://github.com/advisories/GHSA-mjcj-jjh8-28r2"}],"sources":{"cve":[{"id":"CVE-2018-9995","description":"TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login, which run re-branded versions of the original TBK DVR4104 and DVR4216 series, allow remote attackers to bypass authentication via a \"Cookie: uid=admin\" header, as demonstrated by a device.rsp?opt=user\u0026cmd=list request that provides credentials within JSON data in a response.","status":"published","published":"2018-04-10T22:00:00Z","modified":"2024-08-05T07:32:01.171Z","updated_at":"2026-11-02T14:35:02.603326Z"}],"euvd":[{"id":"EUVD-2018-21587","description":"TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login, which run re-branded versions of the original TBK DVR4104 and DVR4216 series, allow remote attackers to bypass authentication via a \"Cookie: uid=admin\" header, as demonstrated by a device.rsp?opt=user\u0026cmd=list request that provides credentials within JSON data in a response.","status":"published","published":"2018-04-10T22:00:00Z","modified":"2024-08-05T07:32:01Z","updated_at":"2026-11-03T02:39:59.5072Z"}],"ghsa":[{"id":"GHSA-mjcj-jjh8-28r2","title":"TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus,...","description":"TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login, which run re-branded versions of the original TBK DVR4104 and DVR4216 series, allow remote attackers to bypass authentication via a \"Cookie: uid=admin\" header, as demonstrated by a device.rsp?opt=user\u0026cmd=list request that provides credentials within JSON data in a response.","status":"published","published":"2022-05-13T01:53:58Z","modified":"2023-02-02T05:02:15Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T14:51:23.915291Z"}],"nvd":[{"id":"CVE-2018-9995","description":"TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login, which run re-branded versions of the original TBK DVR4104 and DVR4216 series, allow remote attackers to bypass authentication via a \"Cookie: uid=admin\" header, as demonstrated by a device.rsp?opt=user\u0026cmd=list request that provides credentials within JSON data in a response.","status":"published","published":"2018-04-10T22:29:00.29Z","modified":"2026-06-17T02:07:27.907Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:04:25.506659Z"}]}}