CVE-2018-14933
upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.
- Score
- CVSS 3.1 9.8 Critical
- Status
- Analyzed - cve@mitre.org
- Published
- 2018-08-04
- Last modified
- 2025-10-21
- Known exploited (CISA KEV)
- since 2024-12-18, action due 2025-01-08: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
- Weaknesses
- CWE-78
Affected products
References
- https://www.exploit-db.com/exploits/45070/
- https://www.exploit-db.com/exploits/46340/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-14933
