Actively exploited · Published Aug 4, 2018 · Assigned by mitre
CVE-2018-14933
Critical 9.8 Exploited
In plain English
A critical-severity OS command injection in NVRmini Devices from NUUO. Attackers are actively exploiting it in the wild (listed by CISA on December 18, 2024). The chance it is exploited in the next 30 days is estimated at 94.8% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei. The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
CISA guidance
The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
Federal agencies must remediate by Jan 8, 2025.
Official description
upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- 45070 exploit, x_refsource_EXPLOIT-DB
- 46340 exploit, x_refsource_EXPLOIT-DB
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-14933 government-resource