Skip to content
Noroxi

NUUO records

28 published records for vendor NUUO. 2 of them have been exploited in the wild (listed in CISA KEV) and 9 have a ready-made attack tool.

Filter by product ↓

Researcher profile

Entered KEV
2 · 7.1%
Weaponized
9 · 32.1%
Pre-auth RCE
10
With a fix record
0%
Median publish → KEV
1699 days

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

  1. 18
  2. 19
  3. 21
  4. 22
  5. 24

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

28 records
  • CVE-2018-14933
    97Now

    upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir parameter for a writeup

    CriticalCVSS 9.8KEVWeaponizedEPSS 94%

    nuuo · nvrmini firmwareAug 4, 2018

  • CVE-2022-23227
    84Now

    NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users

    CriticalCVSS 9.8KEVWeaponizedEPSS 48%

    nuuo · nvrmini2 firmwareJan 14, 2022

  • CVE-2016-5674
    67This week

    __debugging_center_utils___.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.7.5 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1

    CriticalCVSS 9.8WeaponizedEPSS 94%

    netgear · readynas surveillanceAug 31, 2016

  • CVE-2016-5675
    60This week

    handle_daylightsaving.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, NUUO Crystal 2.2.1 through 3.2.0, and NET

    CriticalCVSS 9.8WeaponizedEPSS 70%

    nuuo · crystalAug 31, 2016

  • CVE-2016-5676
    60This week

    cgi-bin/cgi_system in NUUO NVRmini 2 1.7.5 through 2.x, NUUO NVRsolo 1.7.5 through 2.x, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.

    HighCVSS 7.5WeaponizedEPSS 53%

    netgear · readynas surveillanceAug 31, 2016

  • CVE-2018-17888
    60This week

    NUUO CMS all versions 3.1 and prior, The application uses a session identification mechanism that could allow attackers to obtain the active

    CriticalCVSS 9.8WeaponizedEPSS 29%

    nuuo · nuuo cmsOct 12, 2018

  • CVE-2018-17934
    60This week

    NUUO CMS All versions 3.3 and prior the application allows external input to construct a pathname that is able to be resolved outside the in

    CriticalCVSS 9.8WeaponizedEPSS 19%

    nuuo · nuuo cmsNov 27, 2018

  • CVE-2018-17936
    60This week

    NUUO CMS All versions 3.3 and prior the application allows the upload of arbitrary files that can modify or overwrite configuration files to

    CriticalCVSS 9.8WeaponizedEPSS 15%

    nuuo · nuuo cmsNov 27, 2018

  • CVE-2018-18982
    54Plan

    NUUO CMS All versions 3.3 and prior the web server application allows injection of arbitrary SQL characters, which can be used to inject SQL

    HighCVSS 8.8WeaponizedEPSS 62%

    nuuo · nuuo cmsNov 27, 2018

  • CVE-2018-19864
    46Plan

    NUUO NVRmini2 Network Video Recorder firmware through 3.9.1 allows remote attackers to execute arbitrary code or cause a denial of service (

    CriticalCVSS 9.8Proof of conceptEPSS 24%

    nuuo · nvrmini2 firmwareDec 5, 2018

  • CVE-2018-1149
    44Plan

    cgi_system in NUUO's NVRMini2 3.8.0 and below allows remote attackers to execute arbitrary code via crafted HTTP requests.

    CriticalCVSS 9.8No exploitEPSS 15%

    nuuo · nvrmini2 firmwareSep 19, 2018

  • CVE-2019-9653
    42Plan

    NUUO Network Video Recorder Firmware 1.7.x through 3.3.x allows unauthenticated attackers to execute arbitrary commands via shell metacharac

    CriticalCVSS 9.8Proof of conceptEPSS 11%

    nuuo · network video recorder firmwareMay 31, 2019

  • CVE-2018-11523
    42Plan

    upload.php on NUUO NVRmini 2 devices allows Arbitrary File Upload, such as upload of .php files.

    CriticalCVSS 9.8Proof of conceptEPSS 9%

    nuuo · nvrmini 2 firmwareMay 29, 2018

  • CVE-2016-5678
    42Plan

    NUUO NVRmini 2 1.0.0 through 3.0.0 and NUUO NVRsolo 1.0.0 through 3.0.0 have hardcoded root credentials, which allows remote attackers to ob

    CriticalCVSS 9.8Proof of conceptEPSS 8%

    nuuo · nvrmini 2Aug 31, 2016

  • CVE-2018-15716
    41Plan

    NUUO NVRMini2 version 3.9.1 is vulnerable to authenticated remote command injection.

    HighCVSS 8.8Proof of conceptEPSS 18%

    nuuo · nvrmini2 firmwareNov 30, 2018

  • CVE-2016-5680
    40Plan

    Stack-based buffer overflow in cgi-bin/cgi_main in NUUO NVRmini 2 1.7.6 through 3.0.0 and NETGEAR ReadyNAS Surveillance 1.1.2 allows remote

    HighCVSS 8.8Proof of conceptEPSS 16%

    nuuo · nvrmini 2Aug 31, 2016

  • CVE-2018-17890
    40Plan

    NUUO CMS all versions 3.1 and prior, The application uses insecure and outdated software components for functionality, which could allow arb

    CriticalCVSS 9.8No exploitEPSS 3%

    nuuo · nuuo cmsOct 12, 2018

  • CVE-2016-6553
    40Plan

    Nuuo NT-4040 Titan, firmware NT-4040_01.07.0000.0015_1120, uses default credentials

    CriticalCVSS 9.8No exploitEPSS 2%

    nuuo · nt-4040 titan firmwareJul 13, 2018

  • CVE-2018-17894
    40Plan

    NUUO CMS all versions 3.1 and prior, The application creates default accounts that have hard-coded passwords, which could allow an attacker

    CriticalCVSS 9.8No exploitEPSS 2%

    nuuo · nuuo cmsOct 12, 2018

  • CVE-2022-25521
    40Plan

    NUUO v03.11.00 was discovered to contain access control issue.

    CriticalCVSS 9.8No exploitEPSS 1%

    nuuo · network video recorder firmwareMar 28, 2022

  • CVE-2016-5679
    39Monitor

    cgi-bin/cgi_main in NUUO NVRmini 2 1.7.6 through 3.0.0 and NETGEAR ReadyNAS Surveillance 1.1.2 allows remote authenticated users to execute

    HighCVSS 8.8Proof of conceptEPSS 14%

    nuuo · nvrmini 2Aug 31, 2016

  • CVE-2018-17892
    36Monitor

    NUUO CMS all versions 3.1 and prior, The application implements a method of user account control that causes standard account security featu

    HighCVSS 8.8No exploitEPSS 2%

    nuuo · nuuo cmsOct 12, 2018

  • CVE-2016-5677
    34Monitor

    NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 have a hardcoded

    HighCVSS 7.5Proof of conceptEPSS 11%

    netgear · readynas surveillanceAug 31, 2016

  • CVE-2018-1150
    30Monitor

    NUUO's NVRMini2 3.8.0 and below contains a backdoor that would allow an unauthenticated remote attacker to take over user accounts if the fi

    HighCVSS 7.3No exploitEPSS 2%

    nuuo · nvrmini2 firmwareSep 19, 2018

  • CVE-2016-15038
    26Monitor

    NUUO NVRmini 2 deletefile.php path traversal

    MediumCVSS 6.5No exploitEPSS 0%

    nuuo · nvrmini 2Apr 1, 2024