New Mirai botnet infect TBK DVR devices via command injection flaw
The TBK DVR-4104 and DVR-4216 digital video recording devices have a command injection flaw that a new version of the Mirai virus botnet is using to take control of them.
In April 2024, security researcher "netsecfish" revealed the command injection vulnerability, which is tracked under CVE-2024-3721.
The researcher's proof-of-concept (PoC) at the time was a specifically constructed POST request to a vulnerable endpoint that used the manipulation of two parameters (mdb and mdc) to execute shell commands.
Kaspersky now claims to have used netsecfish's Proof of Concept to detect active exploitation of CVE-2024-3721 in its Linux honeypots from a new Mirai botnet variant.
By using the vulnerability to drop an ARM32 malware binary, the attackers are able to communicate with the com...