CVE-2016-5676
HIGHNETGEAR ReadyNAS Surveillance 1.1.1-1.4.1 & NUUO NVRmini2/NVRsolo 1.7.5-2.x - Unauthenticated Admin Password Reset
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2016-5676.
PoCs published by Pedro Ribeiro, including Metasploit module auxiliary/admin/http/nuuo_nvrmini_reset.
AI-analyzed exploit summary The exploit demonstrates multiple vulnerabilities in NUUO NVR devices and NETGEAR ReadyNAS Surveillance, including unauthenticated remote code execution via improper input validation in PHP files. Proofs of concept include command injection via GET parameters to achieve reverse shells as root or admin.
Description
cgi-bin/cgi_system in NUUO NVRmini 2 1.7.5 through 2.x, NUUO NVRsolo 1.7.5 through 2.x, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to reset the administrator password via a cmd=loaddefconfig action.
Exploits (2)
The exploit demonstrates multiple vulnerabilities in NUUO NVR devices and NETGEAR ReadyNAS Surveillance, including unauthenticated remote code execution via improper input validation in PHP files. Proofs of concept include command injection via GET parameters to achieve reverse shells as root or admin.
This Metasploit module exploits a vulnerability in NUUO NVRmini 2 and NETGEAR ReadyNAS Surveillance devices to reset the administrator password by loading default configurations. It supports both authenticated and unauthenticated attacks depending on the firmware version.
References (3)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N