CVE-2018-1150

NUUO's NVRMini2 3.8.0 and below contains a backdoor that would allow an unauthenticated remote attacker to take over user accounts if the file /tmp/moses exists...

CVE-2018-1149

cgisystem in NUUO's NVRMini2 3.8.0 and below allows remote attackers to execute arbitrary code via crafted HTTP requests...

CVE-2018-1150

NUUO's NVRMini2 3.8.0 and below contains a backdoor that would allow an unauthenticated remote attacker to take over user accounts if the file /tmp/moses exists...

Input validation

NUUO's NVRMini2 3.8.0 and below contains a backdoor that would allow an unauthenticated remote attacker to take over user accounts if the file /tmp/moses exists...

CVE-2018-1150

NUUO's NVRMini2 3.8.0 and below contains a backdoor that would allow an unauthenticated remote attacker to take over user accounts if the file /tmp/moses exists...

CVE-2018-1149

cgisystem in NUUO's NVRMini2 3.8.0 and below allows remote attackers to execute arbitrary code via crafted HTTP requests...

CVE-2018-1149

CVE-2018-1149 affects NUUO NVRMini2 (and NVRSolo per ICS advisory) with firmware up to 3.8.0. A stack-based buffer overflow in the HTTP CGI interface (cgi_system) allows remote, unauthenticated code execution via crafted HTTP requests (cookie header causing overflow). Also documented is CVE-2018-...

CVE-2018-1150

CVE-2018-1150 affects NUUO NVRMini2 (all versions

NUUO NVRMini2 3.8 Buffer Overflow

Exploit Title: NUUO NVRMini2 3.8 - 'cgisystem' Buffer Overflow Enable Telnet Date: 2018-09-17 Exploit Author: Jacob Baines Vendor Homepage: https://www.nuuo.com/ Device: NRVMini2 Software Link: https://www.nuuo.com/ProductNode.php?node=2 Versions: 3.8.0 and below Tested Against: 03.07.0000.0011 a...

PT-2018-10607

Name of the Vulnerable Software and Affected Versions NUUO's NVRMini2 versions 3.8.0 and below Description The issue allows remote attackers to execute arbitrary code via crafted HTTP requests. Recommendations For versions 3.8.0 and below, update to a version above 3.8.0 to resolve the issue...

PT-2018-10616

Name of the Vulnerable Software and Affected Versions NUUO's NVRMini2 versions 3.8.0 and below Description The issue allows an unauthenticated remote attacker to take over user accounts if the file /tmp/moses exists. Recommendations For versions 3.8.0 and below, remove the /tmp/moses file to...

CVE-2018-1149: Improper Restriction of Operations within the Bounds of a Memory Buffer

cgisystem in NUUO's NVRMini2 3.8.0 and below allows remote attackers to execute arbitrary code via crafted HTTP requests...

CVE-2018-1150: Undefined Security Weakness

NUUO's NVRMini2 3.8.0 and below contains a backdoor that would allow an unauthenticated remote attacker to take over user accounts if the file /tmp/moses exists...

NUUO NVRMini2 3.8 - cgi_system Buffer Overflow (Enable Telnet)

NUUO NVRMini2 3.8 - cgisystem Buffer Overflow Enable Telnet Exploit Title: NUUO NVRMini2 3.8 - 'cgisystem' Buffer Overflow Enable Telnet Date: 2018-09-17 Exploit Author: Jacob Baines Vendor Homepage: https://www.nuuo.com/ Device: NRVMini2 Software Link: https://www.nuuo.com/ProductNode.php?node=2...

NUUO NVRMini2 3.8 - cgi_system Buffer Overflow (Enable Telnet) Exploit

Exploit Title: NUUO NVRMini2 3.8 - 'cgisystem' Buffer Overflow Enable Telnet Exploit Author: Jacob Baines Vendor Homepage: https://www.nuuo.com/ Device: NRVMini2 Software Link: https://www.nuuo.com/ProductNode.php?node=2 Versions: 3.8.0 and below Tested Against: 03.07.0000.0011 and 03.08.0000.000...

NUUO NVRMini2 3.8 - 'cgi_system' Buffer Overflow (Enable Telnet)

Exploit Title: NUUO NVRMini2 3.8 - 'cgisystem' Buffer Overflow Enable Telnet Date: 2018-09-17 Exploit Author: Jacob Baines Vendor Homepage: https://www.nuuo.com/ Device: NRVMini2 Software Link: https://www.nuuo.com/ProductNode.php?node=2 Versions: 3.8.0 and below Tested Against: 03.07.0000.0011 a...

Zero-Day Bug Allows Hackers to Access CCTV Surveillance Cameras

Between 180,000 and 800,000 IP-based closed-circuit television cameras are vulnerable to a zero-day vulnerability that allows hackers to access surveillance cameras, spy on and manipulate video feeds or plant malware. According to a Tenable Research Advisory issued Monday, the bugs are rated...

NUUO NVRMini2 Multiple Vulnerabilities

The version of NUUO NVRMini2 installed on the remote host is affected by multiple vulnerabilities: - NUUO NVRMini2 web server utilizes CGI binaries in order to handle a variety of commands that require authenticated interaction. Implemented session handling mechanism doesn't validate user's input...

NUUO NVRmini2 / NVRsolo File Upload

File upload vulnerability in NUUO NVRmini2 / NVRsolo upload.php Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

CVE-2018-11523

CVE-2018-11523 : The NUUO NVRmini 2 series (NUUO NVRmini 2, NVRsolo) is affected by a vulnerability in upload.php that enables arbitrary file upload. The issue arises from an upload mechanism that allows uploading files such as PHP scripts, enabling potential remote code execution on affected dev...