CVE-2016-5674
CRITICAL EXPLOITED NUCLEINETGEAR ReadyNAS Surveillance 1.1.1-1.4.1 & NUUO NVRmini2/NVRsolo 1.7.5-3.0.0 - RCE via __debugging_center_utils___.php
Title source: llmExploitation Summary
CVE-2016-5674 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 2 public exploits from researchers including Pedro Ribeiro, including a Metasploit module exploits/linux/http/nuuo_nvrmini_unauth_rce.
A Nuclei detection template is also available.
AI-analyzed exploit summary The exploit demonstrates multiple vulnerabilities in NUUO NVR devices and NETGEAR ReadyNAS Surveillance, including unauthenticated remote code execution via improper input validation in PHP files. Proofs of concept include command injection via GET parameters to achieve reverse shells as root or admin.
Description
__debugging_center_utils___.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.7.5 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the log parameter.
Exploits (2)
The exploit demonstrates multiple vulnerabilities in NUUO NVR devices and NETGEAR ReadyNAS Surveillance, including unauthenticated remote code execution via improper input validation in PHP files. Proofs of concept include command injection via GET parameters to achieve reverse shells as root or admin.
This Metasploit module exploits an unauthenticated remote code execution vulnerability in NUUO NVRmini 2 and NETGEAR ReadyNAS Surveillance via a command injection in the `__debugging_center_utils__.php` endpoint. It handles different payload constraints for each target and executes commands as root or admin.
Nuclei Templates (1)
app="NUUO-NVRmini" || app="NUUO-NVR" || title="Network Video Recorder Login" || app="nuuo-nvrmini" || app="nuuo-nvr" || title="network video recorder login"
References (3)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H