CVE-2018-1149 is a critical remote code execution vulnerability affecting NUUO NVRMini2 devices running firmware version 3.8.0 and below. Attackers can exploit this flaw by sending crafted HTTP requests to the cgi_system component, enabling them to execute arbitrary code on the affected NVR. This vulnerability carries a CVSS score of 9.8 (Critical) due to its network-based attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. While not listed on CISA's KEV catalog, public proof-of-concept exploits exist, and the vulnerability has garnered significant media attention and community discussion, indicating a high potential for exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 3.8.0CPE matchmatch criteria | cpe:2.3:o:nuuo:nvrmini2_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
[R2] Multiple NUUO NVRMini2 Vulnerabilities
Sep 17, 2018[R2] Multiple NUUO NVRMini2 Vulnerabilities
Sep 17, 2018Multiple NUUO NVRMini2 Vulnerabilities
Sep 17, 2018[R2] Multiple NUUO NVRMini2 Vulnerabilities
Sep 17, 2018