105720

https://github.com/tenable/poc/tree/master/nuuo/nvrmini2

https://www.nuuo.com/backend/CKEdit/upload/files/NUUO_NVRsolo_v3_9_1_Release%20note.pdf

https://www.tenable.com/security/research/tra-2018-25

The version of NUUO NVRMini2 installed on the remote host is affected by multiple vulnerabilities:

  - NUUO NVRMini2 web server utilizes CGI binaries in order to handle     a variety of commands that require authenticated interaction.
    Implemented session handling mechanism doesn't validate user's     input properly. Malicious attackers can trigger stack overflow     in session management routines in order to execute arbitrary     code. (CVE-2018-1149)

  - NUUO NVRMini2 web server contains back door functionality. Back     door PHP code (when enabled) allows unauthenticated attacker to     change a password for any registered user except administrator     of the system. (CVE-2018-1150)

CVE-2018-1149

Description

References

Details

Risk Information

CVSS v2.0

CVSS v3.0

Vulnerable Software

Configuration 1

Tenable Plugins