PT-2016-3421 · NetGear+1 · Netgear Readynas Surveillance+2
Pedro Ribeiro
·
Published
2016-08-31
·
Updated
2022-04-04
·
CVE-2016-5674
CVSS v3.1
10
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
NUUO NVRmini versions 1.7.5 through 3.0.0
NUUO NVRsolo versions 1.7.5 through 3.0.0
NETGEAR ReadyNAS Surveillance versions 1.1.1 through 1.4.1
Description
The issue exists due to insufficient input validation in the
debugging center utils .php component of network video surveillance systems. This allows a remote attacker to execute arbitrary PHP code via the log parameter.Recommendations
For NUUO NVRmini versions 1.7.5 through 3.0.0, update to a version that includes the fix for the
debugging center utils .php component.
For NUUO NVRsolo versions 1.7.5 through 3.0.0, update to a version that includes the fix for the debugging center utils .php component.
For NETGEAR ReadyNAS Surveillance versions 1.1.1 through 1.4.1, update to a version that includes the fix for the debugging center utils .php component.
As a temporary workaround, consider restricting access to the debugging center utils .php component until a patch is available.
Avoid using the log parameter in the affected API endpoint until the issue is resolved.Exploit
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Netgear Readynas Surveillance
Nuuo Nvrmini
Nuuo Nvrsolo