CVE-2018-14933

nuuo nvrmini firmware

Published 4 Aug 2018 · updated 17 Jun 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 18 Dec 2024, with a remediation deadline of 8 Jan 2025 for US federal agencies.

Required action: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

Description

upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.

References

www.exploit-db.com/exploits/45070/ · Exploit, Third Party Advisory, VDB Entry
www.exploit-db.com/exploits/46340/ · Exploit, Third Party Advisory, VDB Entry
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-14933 · US Government Resource