Executive brief
NUUO Network Video Recorder is a video management system used by organizations to record and manage surveillance camera feeds. The up.php endpoint allows unauthenticated attackers to read arbitrary files from the server by exploiting improper URL handling, potentially exposing sensitive configuration files, credentials, and surveillance data stored on the device.
Technical details
The vulnerability exists in up.php where user-supplied POST parameter 'url' is processed by fopen() without proper validation or sanitization. Because the fopen() function supports the file:// URI scheme, an attacker can bypass intended restrictions and read local files by submitting a crafted file:// URL. The application reads file contents in 8KB chunks and writes them to /tmp/ with a filename derived from basename() of the URL. No authentication is required to access this endpoint, and the 24-hour execution timeout allows large files to be read. An attacker can exfiltrate sensitive system files, configuration data, and credentials from the affected NVR.
Affected products
- NUUO Network Video Recorder 2.0.0
Timeline
- 2026-09-18: disclosed: CVE-2026-88623 published on NVD