CVE-2018-9995Active Exploitation(tbkvision / tbk-dvr4104)

MEDIUMCVSS 9.8 · CRITICAL

Exploitation ongoing with high activity in latest observed window (2 mentions)

Immediate actions

Prioritize remediation for tbkvision tbk-dvr4104 systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login, which run re-branded versions of the original TBK DVR4104 and DVR4216 series, allow remote attackers to bypass authentication via a "Cookie: uid=admin" header, as demonstrated by a device.rsp?opt=user&cmd=list request that provides credentials within JSON data in a response.

tbkvision CVEs Back to dashboard

5.5/ 10 priority

Sources & remediation

Exploit / PoC references

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

tbk-dvr4104
tbk-dvr4104_firmware
tbk-dvr4216
tbk-dvr4216_firmware

Threat summary

Active exploitation appears in 2 classified signals
Public PoC is present in monitored signal
3 mentions across 2 observed days
Momentum state: stable

What's happening

Active exploitation reported across 2 signals
PoC mentioned or linked in 2 signals
General: 1 classified signal
Peaked at 2 mentions on most recent observed day (2026-10-09)
3 total mentions across 2 days

Affected systems

Vendors

tbkvision

Products

tbk-dvr4104tbk-dvr4104_firmwaretbk-dvr4216tbk-dvr4216_firmware

1 version affected across 4 products

Deep dive

Activity timeline3 mentions / 2d

Signal classification2 categories

Active Exploitation

266.7%

General

133.3%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-24	1	General1
2026-10-09	2	Active Exploitation2

Full discourse3 posts

♫NØX♥H♪@_Why_Noot30d
Active Exploitation
NØX Echo Lineage Signal: CVE-2018-9995 Entity: tbk-dvr4216_firmware Lineage: Public vulnerability → Public exploit/PoC → Observed exploitation → Ransomware campaign use Relationship: - tbk-dvr4216_firmware → CVE-2018-9995 → Evidence → Operational Risk
Post summary
The text reports observed exploitation of CVE-2018-9995 and use in a ransomware campaign. It also mentions a public exploit/PoC, but provides no patch guidance or specific technical vulnerability details.
1000029
9 followersView on X
♫Why♥Not♪@Python_s_30d
Active Exploitation
NØØT Ransomware Watch Classification: Critical CVE: CVE-2018-9995 Product: tbkvision / tbk-dvr4216_firmware Summary: VulnCheck reports real-world exploitation activity affecting tbkvision / tbk-dvr4216_firmware. Evidence: Public PoC/exploit available; Ransomware use confirmed; Active exploitation reported; Live exploitation observed by VulnCheck canaries Impact: The vulnerability is associated with ransomware activity and may contribute to compromise of exposed systems. Action: Prioritize vendor remediation, identify exposed affected systems, and investigate for evidence of exploitation when applicable. Date: 25 Feb 2020 Source: https://vulncheck.com/xdb/5febaf1762ec #NØØT #CyberSecurity #InfoSec #ThreatIntelligence #CyberThreats #CVE #CyberDefense #tbk_dvr4216_firmware #CVE_2018_9995 #ActiveExploitation #Exploit #Ransomware
Post summary
The post reports real-world and live exploitation of CVE-2018-9995 affecting tbkvision firmware, including confirmed ransomware use. It also mentions that a public PoC/exploit is available, but provides no specific exploit tool or remediation details.
0000046
237 followersView on X
Loginsoft Threat Intel@Loginsoft_Intel136d
General
Cytellite recent detection targeting CVE-2018-9995 — http://Vpsvault.host Ltd Visit -- https://cti.loginsoft.com/ip/45.205.1.80 #Loginsoft #Cytellite #Cybersecurity #CVE20189995 #LOVI #ThreatIntelligence #Infosecurity #AI https://t.co/M5tJeNWd0w
Post summary
The tweet mentions a detection of CVE-2018‑9995 but provides no further exploitation, patch, or technical details.
0000030
22 followersView on X

CPE platform detail4 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

4 of 4 entries

Part	Vendor	Product	Version	Target SW	Target HW
HW	tbkvision	tbk-dvr4104	-	-	-
OS	tbkvision	tbk-dvr4104_firmware	-	-	-
HW	tbkvision	tbk-dvr4216	-	-	-
OS	tbkvision	tbk-dvr4216_firmware	-	-	-

Explore more

Back to dashboard tbkvision CVEs tbk-dvr4104 vulnerabilities