Hunt Electronic Hybrid DVR OS Command Injection Vulnerability

An OS command injection vulnerability has been identified in certain hybrid DVR models from Hunt Electronic, specifically the HBF-09KD and HBF-16NK. This vulnerability allows remote attackers with regular privileges to inject and execute arbitrary operating system commands on the affected devices. The issue is present in firmware versions V3.1.67_1786 BB11115 and earlier.

Impact

Exploitation of this vulnerability allows for arbitrary OS command execution on the affected DVRs.

Remediation

Users are advised to update the DVR firmware to version V3.1.70_1806 BB50604 or later.