high8.8Public exploit code
CVE-2018-15716
NUUO NVRMini2 version 3.9.1 is vulnerable to authenticated remote command injection.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- NUUO NVRMini2 3.9.1 - (Authenticated) Command Injection2018-12-04 · webapps · php
Impact
NUUO NVRMini2 version 3.9.1 is vulnerable to authenticated remote command injection. An attacker can send crafted requests to upgrade_handle.php to execute OS commands as root.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nuuo | Nvrmini2 Firmware | Version 3.9.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.securityfocus.com/bid/106059
- https://github.com/tenable/poc/tree/master/nuuo/nvrmini2/cve_2018_15716
- https://www.exploit-db.com/exploits/45948/
- https://www.tenable.com/security/research/tra-2018-41
- http://www.securityfocus.com/bid/106059
- https://github.com/tenable/poc/tree/master/nuuo/nvrmini2/cve_2018_15716
- https://www.exploit-db.com/exploits/45948/
- https://www.tenable.com/security/research/tra-2018-41