Q-See QT Series DVR (QT428/QT5116 family)
From Wiki-IoT
| Q-See QT Series DVR (QT428/QT5116 family) | ||
|---|---|---|
|
Security Grade
Calculator v1
|
Q-See QT Series DVR (QT428/QT5116 family)
Brand: Q-See Category: Analog H.264 standalone DVR (BNC cameras, SATA HDD, web/CMS remote viewing) • Model / Gen: QT family H.264 Network DVR (QT428, QT5116 and related QT4/QT5 models; TBK DVR4104/4216-derived rebrand) Release Date: 2011-06-01 • Status: End of life Classification Date: 2026-10-24 • [www.q-see.com/pages/download Official Website] | |
Contents
Security Evaluation
1. Device Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Known hardware tampering | Rare | [images.homedepot-static.com/catalog/pdfImages/67/670c0313-775c-4350-be86-aa0eae1a9544.pdf 🔗 Proof] | documentary assessment, NOT device testing: QT-family manual documents a consumer DVR enclosure with no tamper switch or seal; physical-hardware tampering exposure is not commonly documented (QT family manual scope). |
| Known vulnerabilities | Very common | [nvd.nist.gov/vuln/detail/CVE-2018-9995 🔗 Proof] | documentary assessment, NOT device testing: NVD CVE-2018-9995 lists QSee among rebranded TBK DVR4104/4216 devices allowing remote authentication bypass via "Cookie: uid=admin" with cleartext credential return (CVSS 3.0 9.8); factory default admin/123456 per official QT manual (TBK-derived QT firmware scope). |
| Prior attacks | Very common | [www.bleepingcomputer.com/news/security/new-hacking-tool-lets-users-access-a-bunch-of-dvrs-and-their-video-feeds/ 🔗 Proof] | documentary assessment, NOT device testing: BleepingComputer documents a public PoC tool, Shodan exposure of tens of thousands of such DVRs (55,000+ in one query) and expected mass scanning of this rebranded class; widely attacked legacy DVR category (CVE-2018-9995 class scope). |
| Updatability | None | [www.q-see.com/pages/download 🔗 Proof] | documentary assessment, NOT device testing: official Qsee download page states all old-model firmware stopped updating after Q-See went out of business in 2019 and no firmware for old models is provided; QT-family units receive no security maintenance (legacy QT models scope). |
| Category Score | Score: 3 / 3 | ||
2. System Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Authentication with other systems | No | [nvd.nist.gov/vuln/detail/CVE-2018-9995 🔗 Proof] | documentary assessment, NOT device testing: the Cookie: uid=admin bypass returns admin credentials without any login, and the DVR has no federated/third-party identity system; authentication across the management interface is bypassable (TBK-derived QT firmware scope). |
| Communications | No encryption | [www.bleepingcomputer.com/news/security/new-hacking-tool-lets-users-access-a-bunch-of-dvrs-and-their-video-feeds/ 🔗 Proof] | documentary assessment, NOT device testing: exploit runs over plain HTTP on port 80 (/device.rsp) and the response carries credentials in cleartext; no TLS on the management stream (CVE-2018-9995 class scope). |
| Storage | No encryption | [images.homedepot-static.com/catalog/pdfImages/67/670c0313-775c-4350-be86-aa0eae1a9544.pdf 🔗 Proof] | documentary assessment, NOT device testing: manual records recording to a plain SATA HDD and AVI backup to USB/PC, with no disk or archive encryption feature documented (QT family manual scope). |
| Category Score | Score: 3 / 3 | ||
3. User Authentication
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Account management | Basic | [images.homedepot-static.com/catalog/pdfImages/67/670c0313-775c-4350-be86-aa0eae1a9544.pdf 🔗 Proof] | documentary assessment, NOT device testing: User Management supports 1 administrator and up to 15 users with custom rights, but no group policy or credential lifecycle controls (QT family manual scope). |
| Authentication | Absent | [nvd.nist.gov/vuln/detail/CVE-2018-9995 🔗 Proof] | documentary assessment, NOT device testing: on vulnerable TBK-derived firmware the web authentication can be bypassed entirely with a static cookie header, making authentication effectively absent for an unauthenticated remote actor (CVE-2018-9995 class scope). |
| Brute-force protection | Absent | [images.homedepot-static.com/catalog/pdfImages/67/670c0313-775c-4350-be86-aa0eae1a9544.pdf 🔗 Proof] | documentary assessment, NOT device testing: QT manual documents no login lockout or throttling; brute-force protection absent (QT family manual scope). |
| Event logging | Access event logged | [images.homedepot-static.com/catalog/pdfImages/67/670c0313-775c-4350-be86-aa0eae1a9544.pdf 🔗 Proof] | documentary assessment, NOT device testing: manual states the DVR supports event log recording and checking with unlimited events, i.e. access/event logging exists locally (QT family manual scope). |
| Passwords | Default/Common/Easy to guess | [images.homedepot-static.com/catalog/pdfImages/67/670c0313-775c-4350-be86-aa0eae1a9544.pdf 🔗 Proof] | documentary assessment, NOT device testing: official QT manual logs in with admin/123456 by default and notes the default password is 123456; changeable later but no forced change or complexity requirement (QT family manual scope). |
| Category Score | Score: 3 / 3 | ||
Technical Specifications
| Property | Details |
|---|---|
| Operating System & App | Embedded Linux firmware (Companion App: ) |
| Hardware (CPU / GPU) | CPU: • GPU: |
| Memory & Storage | Memory: • Storage: |
| Power, Battery & Charging | Battery: • Power: • Charging: |
| Display & Camera | Display: • Camera: |
| Sound & Connectivity | Sound: • Connectivity: |
| Physical (Dimensions & Mass) | Dimensions: • Mass: |
