critical9.8Known exploitedPublic exploit code
CVE-2018-14933
NUUO NVRmini Devices OS Command Injection Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2024-12-18. Federal due date: 2025-01-08.
The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- NUUO NVRmini - upgrade_handle.php Remote Command Execution (Metasploit)2019-02-11 · remote · php · Verified
Impact
upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nuuo | Nvrmini Firmware | Version 2016 |