CVE-2024-3721 | defend.network

What is CVE-2024-3721?

A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical. This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___. The manipulation of the argument mdb/mdc leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260573 was assigned to this vulnerability.

CVSS6.3 NVD 3.1

SeverityMEDIUM

ExploitationNo exploitation reported

EPSS86% · P100

Triage statusNo Known Exploit

ActionPatch within 48 hours

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

NVD published2024-04-13

NVD last modified2026-06-17

Timeline

2024-04-13Published to the U.S. National Vulnerability Database (NVD)
2026-06-17NVD record last updated

Affected product

See advisory

Remediation Steps

Update TBK DVR firmware to the latest available version
Change all default credentials on DVR systems to strong, unique passwords
Restrict network access to DVR systems using firewall rules and VLANs
Monitor for suspicious outbound connections indicating botnet activity
Scan network for Mirai indicators of compromise and IOCs from FortiGuard/Unit 42

References

Referenced in our briefings & reports

Vulnerability Priority Report – Week 3 of April 2026 (April 20 – 26)

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.