Junglewise Threat Intelligence

CVE-2018-14933: NUUO NVRmini Devices OS Command Injection Vulnerability

CVE-2018-14933 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2024-12-18

Executive brief

NUUO NVRmini devices contain an OS command injection vulnerability in upgrade_handle.php. Remote attackers can execute arbitrary commands via shell metacharacters in the uploaddir parameter of a writeuploaddir command.

Affected products

  • NUUO NVRmini firmware 2016
  • NUUO NVRmini

Timeline

  • 2018-08-04: disclosed: NVD Published Date
  • 2024-12-18: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
  • 2025-01-08: other: CISA KEV remediation due date