PT-2016-6632 · NetGear+1 · Netgear Readynas Surveillance+2

Pedro Ribeiro · Published 2016-08-31 · Updated 2017-09-03 · CVE-2016-5676

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions NUUO NVRmini 2 versions 1.7.5 through 2.x NUUO NVRsolo versions 1.7.5 through 2.x NETGEAR ReadyNAS Surveillance versions 1.1.1 through 1.4.1

Description The issue allows remote attackers to reset the administrator password via a cmd=loaddefconfig action in the cgi-bin/cgi system endpoint.

Recommendations For NUUO NVRmini 2 versions 1.7.5 through 2.x, consider restricting access to the cgi-bin/cgi system endpoint until a fix is available. For NUUO NVRsolo versions 1.7.5 through 2.x, avoid using the cmd=loaddefconfig action in the cgi-bin/cgi system endpoint until the issue is resolved. For NETGEAR ReadyNAS Surveillance versions 1.1.1 through 1.4.1, restrict access to the cgi-bin/cgi system endpoint to minimize the risk of exploitation.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2016-5676

Affected Products

Netgear Readynas Surveillance

Nuuo Nvrmini 2

Nuuo Nvrsolo

References · 6

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/nuuo_nvrmini_reset.rb · Exploit
• 🔥 https://exploit-db.com/exploits/40200 · Exploit
• https://osv.dev/vulnerability/CVE-2016-5676 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-5676 · Security Note
• http://kb.cert.org/vuls/id/856152 · Note
• http://securityfocus.com/bid/92318 · Note