Vulnerability Description
MVPower CCTV DVR models, including TV-7104HE 1.8.4 115215B9 and TV7108HE, contain a web shell that is accessible via a /shell URI. A remote unauthenticated attacker can execute arbitrary operating system commands as root. This vulnerability has also been referred to as the "JAWS webserver RCE" because of the easily identifying HTTP response server field. Other firmware versions, at least from 2014 through 2019, can be affected. This was exploited in the wild in 2017 through 2022.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mvpower | Tv-7104He Firmware | 1.8.4_115215b9 |
| Mvpower | Tv-7104He | - |
| Mvpower | Tv7108He Firmware | - |
| Mvpower | Tv7108He | - |
Related Weaknesses (CWE)
References
- https://blog.netlab.360.com/iot_reaper-a-rappid-spreading-new-iot-botnet-en/Third Party Advisory
- https://www.exploit-db.com/exploits/41471ExploitThird Party AdvisoryVDB Entry
- https://www.pentestpartners.com/security-blog/pwning-cctv-cameras/ExploitThird Party Advisory
- https://blog.netlab.360.com/iot_reaper-a-rappid-spreading-new-iot-botnet-en/Third Party Advisory
- https://www.exploit-db.com/exploits/41471ExploitThird Party AdvisoryVDB Entry
- https://www.pentestpartners.com/security-blog/pwning-cctv-cameras/ExploitThird Party Advisory
FAQ
What is CVE-2016-20016?
CVE-2016-20016 is a vulnerability with a CVSS score of 9.8 (CRITICAL). MVPower CCTV DVR models, including TV-7104HE 1.8.4 115215B9 and TV7108HE, contain a web shell that is accessible via a /shell URI. A remote unauthenticated attacker can execute arbitrary operating sys...
How severe is CVE-2016-20016?
CVE-2016-20016 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2016-20016?
Check the references section above for vendor advisories and patch information. Affected products include: Mvpower Tv-7104He Firmware, Mvpower Tv-7104He, Mvpower Tv7108He Firmware, Mvpower Tv7108He.