CVE-2024-7339

High PUBLISHED

TVT DVR TD-2104TS-CL queryDevInfo information disclosure

TVT · DVR TD-2104TS-CL, DVR TD-2108TS-HP, Provision-ISR DVR SH-4050A5-5L(MM), AVISION DVR AV108T

Not yet in CISA KEV

Exploited in the wild PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

High

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

Not yet in CISA KEV

CVSS / EPSS

6.9 Medium

At a Glance

A vulnerability has been found in TVT DVR TD-2104TS-CL, DVR TD-2108TS-HP, Provision-ISR DVR SH-4050A5-5L(MM) and AVISION DVR AV108T and classified as problematic. This vulnerability affects unknown code of the file /queryDevInfo. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-273262 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. In TVT DVR TD-2104TS-CL, DVR TD-2108TS-HP, Provision-ISR DVR SH-4050A5-5L(MM) and AVISION DVR AV108T wurde eine problematische Schwachstelle gefunden. Betroffen ist eine unbekannte Verarbeitung der Datei /queryDevInfo. Dank der Manipulation mit unbekannten Daten kann eine information disclosure-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk passieren. Der Exploit steht zur öffentlichen Verfügung.

nuclei_scanner

CVE Published: Aug 01, 2024
Exploitation Reported: Jun 11, 2026
CVSS: 6.9 Medium
EPSS: —

Remote Low complexity No user interaction Unauthenticated

Affected Versions

48 version rows · page 1 of 2

Vendor	Product	Version	Status
tvt	dvr_td_2014ts_cl	1.3.3.20657B180918.D06.U2\/4A41T\/	Affected
tvt	dvr_td_2014ts_cl	1.3.4.22966B181219.D00.U1\/4A21S\/	Affected
tvt	dvr_td_2014ts_cl	1.3.4.22966B181219.D14.U1\/8A41T\/	Affected
tvt	dvr_td_2014ts_cl	1.3.4.22966B181219.D44.U1\/16A82T\/	Affected
tvt	dvr_td_2014ts_cl	1.3.4.24513B190218.D00.U1\/8A21S\/	Affected
tvt	dvr_td_2018ts_hp	1.3.3.20657B180918.D06.U2\/4A41T\/	Affected
tvt	dvr_td_2018ts_hp	1.3.4.22966B181219.D00.U1\/4A21S\/	Affected
tvt	dvr_td_2018ts_hp	1.3.4.22966B181219.D14.U1\/8A41T\/	Affected
tvt	dvr_td_2018ts_hp	1.3.4.22966B181219.D44.U1\/16A82T\/	Affected
tvt	provision_isr_dvr_sh_4050a5_5l\/mm\/	1.3.3.20657B180918.D06.U2\/4A41T\/	Affected
tvt	dvr_td_2014ts_cl	1.3.4.24879B190222.D00.U2\/8A21S\/	Affected
tvt	dvr_td_2018ts_hp	1.3.4.24513B190218.D00.U\/(8A21S\/	Affected
tvt	dvr_td_2018ts_hp	1.3.4.24879B190222.D00.U2\/8A21S\/	Affected
tvt	provision_isr_dvr_sh_4050a5_5l\/mm\/	1.3.4.22966B181219.D00.U\/(4A21S\/	Affected
tvt	provision_isr_dvr_sh_4050a5_5l\/mm\/	1.3.4.22966B181219.D14.U1\/8A41T\/	Affected
tvt	provision_isr_dvr_sh_4050a5_5l\/mm\/	1.3.4.22966B181219.D44.U1\/16A82T\/	Affected
tvt	provision_isr_dvr_sh_4050a5_5l\/mm\/	1.3.4.24513B190218.D00.U1\/8A21S\/	Affected
tvt	provision_isr_dvr_sh_4050a5_5l\/mm\/	1.3.4.24879B190222.D00.U2\/8A21S\/	Affected
tvt	avision_dvr_av108t	1.3.3.20657B180918.D06.U2\/4A41T\/	Affected
tvt	avision_dvr_av108t	1.3.4.22966B181219.D00.U\/(4A21S\/	Affected
tvt	avision_dvr_av108t	1.3.4.22966B181219.D14.U1\/8A41T\/	Affected
tvt	avision_dvr_av108t	1.3.4.22966B181219.D44.U1\/16A82T\/	Affected
tvt	avision_dvr_av108t	1.3.4.24513B190218.D00.U\/8A21S\/	Affected
tvt	avision_dvr_av108t	1.3.4.24879B190222.D00.U2\/8A21S\/	Affected
TVT	DVR TD-2104TS-CL	1.3.3.20657B180918.D06.U2(4A41T)	Affected

CVE References

Submit #379373 | TVT TD-2104TS-CL, TD-2108TS-HP, SH-4050A5-5L(MM), AV108T, ... 1.3.4.22966B181219.D00.U1(4A21S), 1.3.4.22966B181219.D14.U1(8A41T), 1.3.4.22966B181219.D44.U1(16A82T), 1.3.4.24513B190218.D00.U1 Information Disclosure vuldb.com · Third-Party Advisory https://vuldb.com/?submit.379373
Exploit — netsecfish.notion.site netsecfish.notion.site · Exploit https://netsecfish.notion.site/Sensitive-Device-Information-Disclosur...
VDB-273262 | TVT DVR TD-2104TS-CL queryDevInfo information disclosure vuldb.com · VDB Entry https://vuldb.com/?id.273262
VDB-273262 | CTI Indicators (IOB, IOC, TTP, IOA) vuldb.com · Signature https://vuldb.com/?ctiid.273262

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
The Shadowserver First	2025-08-15 00:00 UTC

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7339.yaml	Apr 25, 2025

CVSS Scores

CVSS v4.0 6.9 Medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS v3.1 5.3 Medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS v3.0 5.3 Medium

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS v2.0 5.0 Medium

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitation Status

Exploited in the wild

Recorded 2026-06-11 00:00:00 UTC · The Shadowserver

Proof of concept available

Recorded 2024-08-05 16:26:18 UTC · GitHub

Weaknesses (CWE)

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

Scanner Integrations

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7339.yaml	Apr 25, 2025

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

RevoltSecurities/CVE-2024-7339

github · Created 2024-08-05 16:26:18 UTC · 18 stars

An Vulnerability detection and Exploitation tool for CVE-2024-7339

TVT DVR Sensitive Device - Information Disclosure

nuclei · Created Unknown

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2024-7339

{
  "cve_id": "CVE-2024-7339",
  "title": "TVT DVR TD-2104TS-CL queryDevInfo information disclosure",
  "affected_vendor": "TVT",
  "affected_product": "DVR TD-2104TS-CL, DVR TD-2108TS-HP, Provision-ISR DVR SH-4050A5-5L(MM), AVISION DVR AV108T",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "High",
  "cvss_score": 6.9,
  "epss_score": null,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2024-7339

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API