PT-2018-12808 · Nuuo · Nuuo Nvrmini

Berk Dusunur + 3 · Publicado 2018-08-04 · Atualizado 2025-02-06 · CVE-2018-14933

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NUUO NVRmini devices (affected versions not specified)

Description The issue allows for remote command execution via shell metacharacters in the uploaddir parameter for a "writeuploaddir" command in the "upgrade handle.php" file on NUUO NVRmini devices.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2018-14933

Produtos afetados

Nuuo Nvrmini

Referências · 11

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/nuuo_nvrmini_upgrade_rce.rb · Exploit
• 🔥 https://exploit-db.com/exploits/46340 · Exploit
• 🔥 https://exploit-db.com/exploits/45070 · Exploit
• https://twitter.com/TMJIntel/status/1869403631524380804 · Publicação no Twitter
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-14933 · Nota
• https://osv.dev/vulnerability/CVE-2018-14933 · Aviso do Fabricante
• https://t.me/cvenotify/104851 · Publicação no Telegram
• https://t.me/cvenotify/110161 · Publicação no Telegram
• https://t.me/cvenotify/110238 · Publicação no Telegram
• https://nuuo.com/wp-content/uploads/2023/03/NUUO-EOL-letter%EF%BC%BFNVRmini-2-and-NVRsolo-series.pdf · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2018-14933 · Nota de Segurança