PT-2016-6631 · NetGear+1 · Netgear Readynas Surveillance+3

Pedro Ribeiro · Published 2016-08-31 · Updated 2017-09-03 · CVE-2016-5675

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NUUO NVRmini 2 versions 1.7.5 through 3.0.0 NUUO NVRsolo versions 1.0.0 through 3.0.0 NUUO Crystal versions 2.2.1 through 3.2.0 NETGEAR ReadyNAS Surveillance versions 1.1.1 through 1.4.1

Description The issue allows remote attackers to execute arbitrary PHP code via the NTPServer parameter in the handle daylightsaving.php file.

Recommendations For NUUO NVRmini 2 versions 1.7.5 through 3.0.0, update to a version outside of this range to resolve the issue. For NUUO NVRsolo versions 1.0.0 through 3.0.0, update to a version outside of this range to resolve the issue. For NUUO Crystal versions 2.2.1 through 3.2.0, update to a version outside of this range to resolve the issue. For NETGEAR ReadyNAS Surveillance versions 1.1.1 through 1.4.1, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the handle daylightsaving.php file to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2016-5675

Affected Products

Netgear Readynas Surveillance

Nuuo Crystal

Nuuo Nvrmini 2

Nuuo Nvrsolo

References · 6

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/nuuo_nvrmini_auth_rce.rb · Exploit
• 🔥 https://exploit-db.com/exploits/40200 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-5675 · Security Note
• https://osv.dev/vulnerability/CVE-2016-5675 · Vendor Advisory
• http://securityfocus.com/bid/92318 · Note
• http://kb.cert.org/vuls/id/856152 · Note