# CVE-2024-3721 — TBK DVR-4104

> As of 2024-08-01, CVE-2024-3721 is a MEDIUM-severity vulnerability in TBK DVR-4104, CVSS v3.1 6.3, EPSS 86.4% (99.7th percentile). Threadlinqs Intelligence links 2 tracked threat campaigns to CVE-2024-3721, most recently “ClingSTUN Linux Backdoor Turns Unpatched IoT Devices Into Proxy Nodes via Public STUN Infrastructure”.

**Last updated:** 2024-08-01

## What is CVE-2024-3721?

A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical. This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___. The manipulation of the argument mdb/mdc leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260573 was assigned to this vulnerability.

The record classifies CVE-2024-3721 under weakness class [CWE-78](https://intel.threadlinqs.com/cwe/CWE-78). Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs low-privilege credentials, needs no user interaction. 2 affected-product entries are recorded, across 1 vendor, listed below. The identifier was first published 924 days ago.

## Severity and exploitation probability

- **CVSS v3.1 base score:** 6.3 — MEDIUM (`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L`)
- **EPSS (FIRST):** 86.4% probability of exploitation in the next 30 days, higher than 99.7% of all scored CVEs
- **CISA KEV:** Not listed in the CISA Known Exploited Vulnerabilities catalog
- **Threadlinqs priority:** 9.1/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
- **Published:** 2024-04-13, last modified 2024-08-01

## Is CVE-2024-3721 being exploited?

Weaponised exploit code for CVE-2024-3721 is publicly available. 1 public proof-of-concept repository is tracked for this identifier. It currently carries a trending score of 38 in the Threadlinqs vulnerability feed.

- [trickest/cve](https://github.com/trickest/cve/blob/main/2024/CVE-2024-3721.md) (trickest)

## Affected products and versions

- **TBK**: DVR-4104, DVR-4216

## How to fix CVE-2024-3721

No vendor patch reference has been recorded for CVE-2024-3721 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise.

## Threat activity tracking CVE-2024-3721

2 tracked threats in the Threadlinqs corpus reference CVE-2024-3721, either in the campaign’s CVE list or as an indicator on the campaign record.

- [ClingSTUN Linux Backdoor Turns Unpatched IoT Devices Into Proxy Nodes via Public STUN Infrastructure](https://intel.threadlinqs.com/threat/TL-2026-2934) — HIGH · 2026-10-05
- [Cling IoT botnet masquerades as Google STUN traffic for C2, exploiting Realtek Jungle SDK CVE-2021-35394](https://intel.threadlinqs.com/threat/TL-2026-2857) — CRITICAL · 2026-10-03

## Sources

Enriched from CVE.org, FIRST EPSS, GitHub Security Advisories, public proof-of-concept repositories. Last verified by Threadlinqs on 2026-10-10.

**Exploit and proof of concept**

- [github.com — exploit](https://github.com/netsecfish/tbk_dvr_command_injection)

**Technical analysis**

- [vuldb.com — vdb entry](https://vuldb.com/?id.260573)

**Third-party advisory**

- [vuldb.com — signature](https://vuldb.com/?ctiid.260573)
- [vuldb.com — third party advisory](https://vuldb.com/?submit.314969)

Canonical: https://intel.threadlinqs.com/cve/CVE-2024-3721
Full detection coverage and IOCs for threats exploiting CVE-2024-3721 via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp