Executive brief
NUUO Network Video Recorder is a surveillance system used to manage and record video from network cameras across organizations. A vulnerability in the privilege import function allows unauthenticated attackers to execute arbitrary system commands on the device, potentially giving them complete control over the recorder, stored video, and network access.
Technical details
The vulnerability is a command injection flaw in handle_import_privilege.php that occurs when the application receives a POST parameter "h" matching a hardcoded hash value (e0592acf1fdf0754dccc4b818335f15d420da7c9). When this condition is met, the application directly executes arbitrary system commands provided in the "x" POST parameter via system() without sanitization or validation. The attack requires network access to the affected endpoint but no authentication. An attacker can achieve remote code execution (RCE) with the privileges of the web server process. The vulnerability was disclosed as a zero-day affecting NUUO Network Video Recorder 2.0.0, with confirmed exploited instances on the public internet as of the advisory date.
Affected products
- NUUO Network Video Recorder 2.0.0
Timeline
- 2026-09-18: disclosed
- 2026-09-16: exploited: Published PoC and evidence of exploitation in the wild as of advisory date