Description
NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 have a hardcoded qwe23622260 password for the nuuoeng account, which allows remote attackers to obtain sensitive information via an __nvr_status___.php request.
Exploits (1)
exploitdb
WORKING POC
by Pedro Ribeiro · textremotehardware
https://www.exploit-db.com/exploits/40200
References (3)
Core 3
Core References
Third Party Advisory, US Government Resource third-party-advisory
x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/856152
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/92318
Exploit, Third Party Advisory exploit
x_refsource_exploit-db
https://www.exploit-db.com/exploits/40200/
Scores
CVSS v3
7.5
EPSS
0.1923
EPSS Percentile
95.4%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-200
Status
published
Products (32)
netgear/readynas_surveillance
1.1.1
netgear/readynas_surveillance
1.1.2
netgear/readynas_surveillance
1.2.0.4
netgear/readynas_surveillance
1.3.2.4
netgear/readynas_surveillance
1.3.2.14
netgear/readynas_surveillance
1.4.0
netgear/readynas_surveillance
1.4.1
netgear/readynas_surveillance
1.4.2
nuuo/nvrmini_2
1.7.5
nuuo/nvrmini_2
1.7.6
... and 22 more
Published
Aug 31, 2016
Tracked Since
Feb 18, 2026