Description
DVR，全称为Digital Video (硬盘录像机)，是⼀套进行图像计算存储处理的计算机系统，具有对图像/语音和动态帧等进行长时间录像、录音、远程监视和控制的功能。TBK DVR硬盘录像机 device.rsp 接口处存在命令执行漏洞，未经身份验证的远程攻击者可以利用此漏洞绕过cookie认证执行任意系统指令，写入后门文件，获取录像机shell权限。
TBK DVR 硬盘录像机 /device.rsp 命令执行漏洞（CVE-2024-3721）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.ddpoc.com/DVB-2024-7077.html
https://xsx.tw/exploit/3584/
https://cloud.tencent.cn/developer/article/2411176
https://cn-sec.com/archives/2758554.html
https://nvd.nist.gov/vuln/detail/CVE-2024-3721
https://www.tenable.com/cve/CVE-2024-3721
https://advisories.checkpoint.com/defense/advisories/public/2024/cpai-2024-0254.html/
https://vuldb.com/vuln/260573
https://fortiguard.fortinet.com/outbreak-alert/tbk-dvrs-botnet-attack
https://thehackernews.com/2026/04/mirai-variant-nexcorium-exploits-cve.html