CVE-2018-9995: Tbkvision Tbk-DVR4104 Firmware

Critical severity, CVSS 9.8. EPSS: 82.3% chance of exploitation in the next 30 days.

TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login, which run re-branded versions of the original TBK DVR4104 and DVR4216 series, allow remote attackers to bypass authentication via a "Cookie: uid=admin" header, as demonstrated by a device.rsp?opt=user&cmd=list request that provides credentials within JSON data in a response.

Affected products

• Tbkvision Tbk-DVR4104 Firmware: affected versions not specified
• Tbkvision Tbk-DVR4216 Firmware: affected versions not specified

Published 2018-04-10. Last modified 2026-06-17.