CVE-2016-5675

The exploit demonstrates multiple vulnerabilities in NUUO NVR devices and NETGEAR ReadyNAS Surveillance, including unauthenticated remote code execution via improper input validation in PHP files. Proofs of concept include command injection via GET parameters to achieve reverse shells as root or admin.

This Metasploit module exploits an authenticated remote code execution vulnerability in NUUO NVRmini 2, Crystal, and NETGEAR ReadyNAS Surveillance by injecting commands into the NTPServer parameter of handle_daylightsaving.php. It supports multiple targets and payload types.