CVE-2018-1149 Code injection in NUUO NVRMini2
Remote attackers can execute arbitrary code on NUUO NVRMini2 devices via crafted HTTP requests to the cgi_system component.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-1149?
CVE-2018-1149 is a critical code injection vulnerability in NUUO NVRMini2, published on 19 Sep 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
cgi_system in NUUO's NVRMini2 3.8.0 and below allows remote attackers to execute arbitrary code via crafted HTTP requests.
Weakness: CWE-119
Which versions are affected by CVE-2018-1149?
It affects 1 product.
Products include Nuuo Nvrmini2 Firmware.
How do I fix CVE-2018-1149?
No fix has been published for CVE-2018-1149 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2018-1149 being exploited?
There is no known exploitation of CVE-2018-1149 in the wild and no public exploit code.
Other vulnerabilities in NUUO NVRMini2
Sources
Also known as GHSA-wrq3-jg5x-9pp3.