CVE-2016-5675
CRITICALNETGEAR ReadyNAS Surveillance 1.1.1-1.4.1 - Remote Code Execution via NTPServer Parameter
Title source: manualExploitation Summary
EIP tracks 2 public exploits for CVE-2016-5675.
PoCs published by Pedro Ribeiro, including Metasploit module exploits/linux/http/nuuo_nvrmini_auth_rce.
AI-analyzed exploit summary The exploit demonstrates multiple vulnerabilities in NUUO NVR devices and NETGEAR ReadyNAS Surveillance, including unauthenticated remote code execution via improper input validation in PHP files. Proofs of concept include command injection via GET parameters to achieve reverse shells as root or admin.
Description
handle_daylightsaving.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, NUUO Crystal 2.2.1 through 3.2.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the NTPServer parameter.
Exploits (2)
The exploit demonstrates multiple vulnerabilities in NUUO NVR devices and NETGEAR ReadyNAS Surveillance, including unauthenticated remote code execution via improper input validation in PHP files. Proofs of concept include command injection via GET parameters to achieve reverse shells as root or admin.
This Metasploit module exploits an authenticated remote code execution vulnerability in NUUO NVRmini 2, Crystal, and NETGEAR ReadyNAS Surveillance by injecting commands into the NTPServer parameter of handle_daylightsaving.php. It supports multiple targets and payload types.
References (3)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H