NUUO · NVRmini Devices

CVE-2018-14933

NUUO NVRmini Devices OS Command Injection Vulnerability

Exploited in attacks Critical 9.8 Attack chance: 95%

What it is

upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.

CISA: NUUO NVRmini devices contain an OS command injection vulnerability. This vulnerability allows remote command execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.

What to do

The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

Deadline for US federal agencies: January 8, 2025

Added to the CISA list: December 18, 2024
Published: August 4, 2018
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 95% in the top 0.1% of all known vulnerabilities
Weakness: CWE-78
More details: NVD · CVE.org · CISA

All references (2)

More exploited flaws from NUUO

Added	Vulnerability	Product	Severity	Attack chance
Dec 18, 2024	Missing Authentication Vulnerability CVE-2022-23227	NVRmini2 Devices	Critical 9.8	48%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.