CVE-2024-7339
📋 TL;DR
This vulnerability allows remote attackers to access sensitive device information via the /queryDevInfo endpoint on affected DVR systems. It affects TVT, Provision-ISR, and AVISION DVR models, potentially exposing configuration details, network settings, or other sensitive data to unauthorized parties.
💻 Affected Systems
- TVT DVR TD-2104TS-CL
- TVT DVR TD-2108TS-HP
- Provision-ISR DVR SH-4050A5-5L(MM)
- AVISION DVR AV108T
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain complete device configuration including passwords, network settings, and system information, enabling further attacks or device takeover.
Likely Case
Attackers gather sensitive information about device configuration and network topology, facilitating reconnaissance for subsequent attacks.
If Mitigated
Information exposure is limited to non-critical data due to network segmentation and access controls.
🎯 Exploit Status
Exploit details are publicly available. Simple HTTP request to /queryDevInfo endpoint returns sensitive information without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available - vendor did not respond to disclosure
Restart Required: No
Instructions:
No official patch available. Consider workarounds or replacement with supported devices.
🔧 Temporary Workarounds
Network Access Control
allRestrict network access to DVR management interfaces using firewall rules
Endpoint Blocking
allBlock access to /queryDevInfo endpoint at web application firewall or reverse proxy
🧯 If You Can't Patch
- Isolate affected DVRs in separate network segments with strict firewall rules
- Implement network monitoring for unusual access patterns to /queryDevInfo endpoint
🔍 How to Verify
Check if Vulnerable:
Send HTTP GET request to http://[DVR_IP]/queryDevInfo and check if sensitive information is returned without authenticationCheck Version:
Check device web interface or serial console for firmware version informationVerify Fix Applied:
After implementing workarounds, verify /queryDevInfo endpoint is inaccessible or returns appropriate access denied responses📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /queryDevInfo from unauthorized IPs
- Unusual information disclosure in web server logs
Network Indicators:
- HTTP GET requests to /queryDevInfo endpoint
- Responses containing device configuration data
SIEM Query:
source_ip=* AND url_path="/queryDevInfo" AND response_size>1000