NUUO.Surveillance.Application.UNAUTH.Remote.Code.Execution

Description

This indicates an attack attempt to exploit a remote Code Execution vulnerability in NUUO and Netgear Network Video Recorder (NVR) products.
The vulnerability is due to insufficient checks when handling HTTP request from client. A remote attacker may be able to exploit this to execute arbitrary code on vulnerable systems via a crafted HTTP request.

Affected Products

NUUO NVRmini 2, versions 1.7.5 to 3.0.0
NUUO NVRsolo, versions 1.0.0 to 3.0.0
NUUO Crystal, versions 2.2.1 to 3.2.0
ReadyNAS Surveillance, both x86 and ARM, versions 1.1.1 to 1.4.1

Impact

System Compromise: Remote attackers can gain control of vulnerable systems.

Recommended Actions

Currently we are unaware of any vendor supplied patch for this issue.

References