cgi_system in NUUO's NVRMini2 3.8.0 and below allows remote attackers to execute arbitrary code via crafted HTTP requests.

The version of NUUO NVRMini2 installed on the remote host is affected by multiple vulnerabilities:

  - NUUO NVRMini2 web server utilizes CGI binaries in order to handle     a variety of commands that require authenticated interaction.
    Implemented session handling mechanism doesn't validate user's     input properly. Malicious attackers can trigger stack overflow     in session management routines in order to execute arbitrary     code. (CVE-2018-1149)

  - NUUO NVRMini2 web server contains back door functionality. Back     door PHP code (when enabled) allows unauthenticated attacker to     change a password for any registered user except administrator     of the system. (CVE-2018-1150)

Detections

Analytics

CVE-2018-1149

critical

Tenable Plugins

critical