Vulnerabilities

TI-2022-07365 CVE-2022-23227 · GHSA-5f63-p3w5-jphc

NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR…

CRITICAL 100KEV

NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.48497 Published 2022-01-14 No fix listed CWE-306

TI-2018-14073 CVE-2018-19864 · GHSA-w4qr-pphv-89c3

NUUO NVRmini2 Network Video Recorder firmware through 3.9.1 allows remote attackers to…

MEDIUM 63

NUUO NVRmini2 Network Video Recorder firmware through 3.9.1 allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow), resulting in ability to read camera feeds or reconfigure the d…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.24808 Published 2018-12-05 No fix listed CWE-119

TI-2018-11204 CVE-2018-15716 · GHSA-88f8-4pc7-v956

OS command injection in NUUO NVRMini2

MEDIUM 56

NUUO NVRMini2 version 3.9.1 is vulnerable to authenticated remote command injection.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.18498 Published 2018-11-30 No fix listed CWE-78

TI-2018-01066 CVE-2018-1150 · GHSA-f3q2-v6jc-rpmv

NUUO's NVRMini2 3.8.0 and below contains a backdoor that would allow an unauthenticated…

LOW 36

NUUO's NVRMini2 3.8.0 and below contains a backdoor that would allow an unauthenticated remote attacker to take over user accounts if the file /tmp/moses exists.

CVSS 3.0HIGH 7.3 Network No auth No interaction EPSS 0.02102 Published 2018-09-19 No fix listed

TI-2018-01065 CVE-2018-1149 · GHSA-wrq3-jg5x-9pp3

Memory corruption in NUUO NVRMini2

MEDIUM 58

cgi_system in NUUO's NVRMini2 3.8.0 and below allows remote attackers to execute arbitrary code via crafted HTTP requests.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.15106 Published 2018-09-19 No fix listed CWE-119