PT-2025-6881 · Nuuo · Nuuo Camera

Alc9700 · Published 2025-02-16 · Updated 2026-04-14 · CVE-2025-1338

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions NUUO Camera versions prior to 20250203

Description A critical issue exists in NUUO Camera that allows for remote command injection. The issue affects the print file function within the /handle config.php file. Manipulation of the log argument can lead to arbitrary command execution. The vulnerability is remotely exploitable, and the exploit has been publicly disclosed. The vendor was informed of the issue but did not respond.

Recommendations Versions prior to 20250203 should be updated. As a temporary workaround, consider restricting access to the /handle config.php file. Avoid using the log parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Command Injection

Special Elements Injection

Weakness Enumeration

CWE-77

CWE-74

Related Identifiers

CVE-2025-1338

Affected Products

Nuuo Camera

References · 15

• 🔥 https://pan.baidu.com/s/1YW52iM0ehUfFKa_CiTHBjQ?from=init&pwd=kqec · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-1338 · Security Note
• https://twitter.com/pdnuclei_bot/status/2022068228131033520 · Twitter Post
• https://twitter.com/CVEnew/status/1891082901686525966 · Twitter Post
• https://t.me/cvedetector/18183 · Telegram Post
• https://t.me/cvenotify/111512 · Telegram Post
• https://t.me/aptreports/24294 · Telegram Post
• https://twitter.com/rst_cloud/status/1997228367830028606 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1891086367544803696 · Twitter Post
• https://vuldb.com/?submit.493912 · Note
• https://vuldb.com/?ctiid.295954 · Note
• https://t.me/aptreports/24296 · Telegram Post
• https://t.me/latest_high_impact_cve/1836 · Telegram Post
• https://twitter.com/ctiwatchcloud/status/2043857072828158052 · Twitter Post
• https://vuldb.com/?id.295954 · Note