CVE-2024-3721 — TBK DVR-4104 Vulnerability

What is CVE-2024-3721?

A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical. This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___. The manipulation of the argument mdb/mdc leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260573 was assigned to this vulnerability.

The record classifies CVE-2024-3721 under weakness class CWE-78. Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs low-privilege credentials, needs no user interaction. 2 affected-product entries are recorded, across 1 vendor, listed below. The identifier was first published 924 days ago.

Severity and exploitation probability

CVSS v3.1 base score: 6.3 — MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS (FIRST): 86.4% probability of exploitation in the next 30 days, higher than 99.7% of all scored CVEs
CISA KEV: Not listed in the CISA Known Exploited Vulnerabilities catalog
Threadlinqs priority: 9.1/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
Published: 2024-04-13, last modified 2024-08-01

Is CVE-2024-3721 being exploited?

Weaponised exploit code for CVE-2024-3721 is publicly available. 1 public proof-of-concept repository is tracked for this identifier. It currently carries a trending score of 38 in the Threadlinqs vulnerability feed.

trickest/cve (trickest)

Affected products and versions

TBK: DVR-4104, DVR-4216

How to fix CVE-2024-3721

No vendor patch reference has been recorded for CVE-2024-3721 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise.

Threat activity tracking CVE-2024-3721

2 tracked threats in the Threadlinqs corpus reference CVE-2024-3721, either in the campaign’s CVE list or as an indicator on the campaign record.

ClingSTUN Linux Backdoor Turns Unpatched IoT Devices Into Proxy Nodes via Public STUN Infrastructure — HIGH · 2026-10-05
Cling IoT botnet masquerades as Google STUN traffic for C2, exploiting Realtek Jungle SDK CVE-2021-35394 — CRITICAL · 2026-10-03

Sources

Enriched from CVE.org, FIRST EPSS, GitHub Security Advisories, public proof-of-concept repositories. Last verified by Threadlinqs on 2026-10-10.

CVE-2024-3721 — TBK DVR-4104