Vulnerability Details : CVE-2016-20016
MVPower CCTV DVR models, including TV-7104HE 1.8.4 115215B9 and TV7108HE, contain a web shell that is accessible via a /shell URI. A remote unauthenticated attacker can execute arbitrary operating system commands as root. This vulnerability has also been referred to as the "JAWS webserver RCE" because of the easily identifying HTTP response server field. Other firmware versions, at least from 2014 through 2019, can be affected. This was exploited in the wild in 2017 through 2022.
Products affected by CVE-2016-20016
- cpe:2.3:o:mvpower:tv-7104he_firmware:1.8.4_115215b9:*:*:*:*:*:*:*
- cpe:2.3:o:mvpower:tv7108he_firmware:-:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2016-20016
14.80%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 96 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2016-20016
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
References for CVE-2016-20016
-
https://www.pentestpartners.com/security-blog/pwning-cctv-cameras/
Pwning CCTV cameras | Pen Test PartnersExploit;Third Party Advisory
-
https://blog.netlab.360.com/iot_reaper-a-rappid-spreading-new-iot-botnet-en/
IoT_reaper: A Rappid Spreading New IoT BotnetThird Party Advisory
-
https://www.exploit-db.com/exploits/41471
MVPower DVR TV-7104HE 1.8.4 115215B9 - Shell Command Execution (Metasploit) - ARM remote ExploitExploit;Third Party Advisory;VDB Entry
Jump to