Nuuo vulnerabilities2 known to be exploited.
Nuuo has 26 published vulnerabilities across 19 products in our catalogue. 2 of them are on the list of flaws known to be exploited, so criminals are using them now. The most affected product is Nvrmini 2, with 8. If you run Nuuo software, patch the exploited flaws first.
The most recent Nuuo flaw added to the known-exploited list is CVE-2018-14933, on 18 December 2024. We keep watching the known-exploited list.
Which Nuuo products have the most vulnerabilities?
Nvrmini 2 leads with 8 published vulnerabilities. Open a product to see its versions and which of its flaws criminals are already using.
Which Nuuo vulnerabilities are being exploited?
2 flaws are on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 9.8NUUO NVRmini Devices OS Command Injection Vulnerability
NUUO NVRmini devices contain an OS command injection vulnerability.
- 9.8NUUO NVRmini2 Devices Missing Authentication Vulnerability
NUUO NVRmini2 devices contain a missing authentication vulnerability that allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users.
Which Nuuo flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 95%
upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.
- 95%CVE-2016-5674Critical
__debugging_center_utils___.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.7.5 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via...
- 71%CVE-2016-5675Critical
handle_daylightsaving.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, NUUO Crystal 2.2.1 through 3.2.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to...
- 61%CVE-2018-18982High
NUUO CMS All versions 3.3 and prior the web server application allows injection of arbitrary SQL characters, which can be used to inject SQL into an executing statement and allow arbitrary code execution.
- 54%CVE-2016-5676High
cgi-bin/cgi_system in NUUO NVRmini 2 1.7.5 through 2.x, NUUO NVRsolo 1.7.5 through 2.x, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to reset the administrator password via a...
- 48%
NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication.
- 30%CVE-2018-17888Critical
NUUO CMS all versions 3.1 and prior, The application uses a session identification mechanism that could allow attackers to obtain the active session ID, which could allow arbitrary remote code execution.
- 25%CVE-2018-19864Critical
NUUO NVRmini2 Network Video Recorder firmware through 3.9.1 allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow), resulting in ability to read camera feeds or reconfigure...
- 20%CVE-2018-17934Critical
NUUO CMS All versions 3.3 and prior the application allows external input to construct a pathname that is able to be resolved outside the intended directory.
- 18%CVE-2018-15716High
NUUO NVRMini2 version 3.9.1 is vulnerable to authenticated remote command injection.
All Nuuo products we track.
11 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.
- Nvrmini 2nvrmini_28 vulnerabilities19 versions
- Nuuo CMSnuuo_cms7 vulnerabilities28 versions
- Nvrsolonvrsolo7 vulnerabilities19 versions
- Nvrmini2 Firmwarenvrmini2_firmware5 vulnerabilities54 versions
- Network Video Recorder Firmwarenetwork_video_recorder_firmware2 vulnerabilities6 versions
- Nvrsolo Firmwarenvrsolo_firmware2 vulnerabilities2 versions
- Crystalcrystal1 vulnerability4 versions
- Nt-4040 Titan Firmwarent-4040_titan_firmware1 vulnerability1 version
- Nvrmini 2 Firmwarenvrmini_2_firmware1 vulnerability1 version
- Nvrmini Firmwarenvrmini_firmware1 vulnerability1 version
- Unnounno0 vulnerabilities1 version
This directory lists the 11 Nuuo products with at least one tracked version, of 19 in our catalogue.
Running Nuuo? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
NUUO NVRmini devices contain an OS command injection vulnerability. This vulnerability allows remote command execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.
- Matched to
- Nvrmini on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
Our catalogue lists 26 published vulnerabilities across 19 products and 136 versions from Nuuo. The most recent Nuuo flaw added to the known-exploited list is CVE-2018-14933, on 18 December 2024.
2 Nuuo vulnerabilities are on the list of flaws known to be exploited. The most recently added are CVE-2018-14933 and CVE-2022-23227. The full list is on this page.
Nvrmini 2, with 8 published vulnerabilities. Its own page lists the ones known to be exploited.
Create a Precursor Intelligence account and track the Nuuo products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.