PT-2016-3421 · NetGear+1 · Netgear Readynas Surveillance+2

Pedro Ribeiro

·

Publicado

2016-08-31

·

Atualizado

2022-04-04

·

CVE-2016-5674

CVSS v3.1

10

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions NUUO NVRmini versions 1.7.5 through 3.0.0 NUUO NVRsolo versions 1.7.5 through 3.0.0 NETGEAR ReadyNAS Surveillance versions 1.1.1 through 1.4.1
Description The issue exists due to insufficient input validation in the debugging center utils .php component of network video surveillance systems. This allows a remote attacker to execute arbitrary PHP code via the log parameter.
Recommendations For NUUO NVRmini versions 1.7.5 through 3.0.0, update to a version that includes the fix for the debugging center utils .php component. For NUUO NVRsolo versions 1.7.5 through 3.0.0, update to a version that includes the fix for the debugging center utils .php component. For NETGEAR ReadyNAS Surveillance versions 1.1.1 through 1.4.1, update to a version that includes the fix for the debugging center utils .php component. As a temporary workaround, consider restricting access to the debugging center utils .php component until a patch is available. Avoid using the log parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

RCE

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2022-02662
CVE-2016-5674

Produtos afetados

Netgear Readynas Surveillance
Nuuo Nvrmini
Nuuo Nvrsolo