PT-2019-19779 · Nuuo · Nuuo Network Video Recorder

Published 2019-05-31 · Updated 2020-08-24 · CVE-2019-9653

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NUUO Network Video Recorder Firmware versions 1.7.x through 3.3.x

Description The issue allows unauthenticated attackers to execute arbitrary commands. This is achieved by using shell metacharacters in the handle load config.php file.

Recommendations For versions 1.7.x through 3.3.x, update to a version that contains a fix for this issue to prevent arbitrary command execution. As a temporary workaround, consider restricting access to the handle load config.php file until a patch is available.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2019-9653

Affected Products

Nuuo Network Video Recorder

References · 5

• 🔥 https://github.com/grayoneday/CVE-2019-9653 · Exploit
• https://osv.dev/vulnerability/CVE-2019-9653 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-9653 · Security Note
• https://nuuo.com/DownloadMainpage.php · Vendor Advisory
• https://nccst.nat.gov.tw/NewsRSS?lang=en&RSSType=mssecurity · Note