Nuuo
20 CVEs across 23 Nuuo products. Browse Nuuo vulnerabilities, severities, and proof-of-concept exploits.
Nuuo products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-1338 | High | 7.3 | 2025-02-16 | A vulnerability was found in NUUO Camera up to 20250203. It has been declared as critical. This vulnerability affects the function print_file of the file /hand… |
CVE-2016-15038 | Medium | 6.5 | 2024-04-01 | A vulnerability, which was classified as critical, was found in NUUO NVRmini 2 up to 3.0.8. Affected is an unknown function of the file /deletefile.php. The ma… |
CVE-2024-2995 | Medium | 5.4 | 2024-03-27 | A vulnerability was found in NUUO Camera up to 20240319 and classified as problematic. This issue affects some unknown processing of the file /deletefile.php… |
CVE-2022-33119 | Medium | 6.1 | 2022-06-21 | NUUO Network Video Recorder NVRsolo v03.06.02 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via login.php. |
CVE-2022-25521 | Critical | 9.8 | 2022-03-29 | NUUO v03.11.00 was discovered to contain access control issue. |
CVE-2022-23227 | Critical | 9.8 | 2022-01-14 | NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lac… |
CVE-2021-45812 | Medium | 6.1 | 2021-12-28 | NUUO Network Video Recorder NVRsolo 3.9.1 is affected by a Cross Site Scripting (XSS) vulnerability. An attacker can steal the user's session by injecting mali… |
CVE-2019-9653 | Critical | 9.8 | 2019-05-31 | NUUO Network Video Recorder Firmware 1.7.x through 3.3.x allows unauthenticated attackers to execute arbitrary commands via shell metacharacters to handle_load… |
CVE-2018-19864 | Critical | 9.8 | 2018-12-05 | NUUO NVRmini2 Network Video Recorder firmware through 3.9.1 allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow), r… |
CVE-2018-15716 | High | 8.8 | 2018-11-30 | NUUO NVRMini2 version 3.9.1 is vulnerable to authenticated remote command injection. An attacker can send crafted requests to upgrade_handle.php to execute OS… |
CVE-2018-18982 | High | 8.8 | 2018-11-27 | NUUO CMS All versions 3.3 and prior the web server application allows injection of arbitrary SQL characters, which can be used to inject SQL into an executing… |
CVE-2018-17936 | Critical | 9.8 | 2018-11-27 | NUUO CMS All versions 3.3 and prior the application allows the upload of arbitrary files that can modify or overwrite configuration files to the server, which… |
CVE-2018-17934 | Critical | 9.8 | 2018-11-27 | NUUO CMS All versions 3.3 and prior the application allows external input to construct a pathname that is able to be resolved outside the intended directory. T… |
CVE-2018-17894 | Critical | 9.8 | 2018-10-12 | NUUO CMS all versions 3.1 and prior, The application creates default accounts that have hard-coded passwords, which could allow an attacker to gain privileged… |
CVE-2018-17892 | High | 8.8 | 2018-10-12 | NUUO CMS all versions 3.1 and prior, The application implements a method of user account control that causes standard account security features to not be utili… |
CVE-2018-17890 | Critical | 9.8 | 2018-10-12 | NUUO CMS all versions 3.1 and prior, The application uses insecure and outdated software components for functionality, which could allow arbitrary code executi… |
CVE-2018-17888 | Critical | 9.8 | 2018-10-12 | NUUO CMS all versions 3.1 and prior, The application uses a session identification mechanism that could allow attackers to obtain the active session ID, which… |
CVE-2018-1150 | High | 7.3 | 2018-09-19 | NUUO's NVRMini2 3.8.0 and below contains a backdoor that would allow an unauthenticated remote attacker to take over user accounts if the file /tmp/moses exist… |
CVE-2018-1149 | Critical | 9.8 | 2018-09-19 | cgi_system in NUUO's NVRMini2 3.8.0 and below allows remote attackers to execute arbitrary code via crafted HTTP requests. |
CVE-2018-14933 | Critical | 9.8 | 2018-08-04 | upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command. |
CVE-2016-6553 | Critical | 9.8 | 2018-07-13 | Nuuo NT-4040 Titan, firmware NT-4040_01.07.0000.0015_1120, uses non-random default credentials of: admin:admin and localdisplay:111111. A remote network attack… |
CVE-2018-11523 | Critical | 9.8 | 2018-05-29 | upload.php on NUUO NVRmini 2 devices allows Arbitrary File Upload, such as upload of .php files. |
CVE-2016-5680 | High | 8.8 | 2016-08-31 | Stack-based buffer overflow in cgi-bin/cgi_main in NUUO NVRmini 2 1.7.6 through 3.0.0 and NETGEAR ReadyNAS Surveillance 1.1.2 allows remote authenticated users… |
CVE-2016-5679 | High | 8.8 | 2016-08-31 | cgi-bin/cgi_main in NUUO NVRmini 2 1.7.6 through 3.0.0 and NETGEAR ReadyNAS Surveillance 1.1.2 allows remote authenticated users to execute arbitrary commands… |
CVE-2016-5678 | Critical | 9.8 | 2016-08-31 | NUUO NVRmini 2 1.0.0 through 3.0.0 and NUUO NVRsolo 1.0.0 through 3.0.0 have hardcoded root credentials, which allows remote attackers to obtain administrative… |
CVE-2016-5677 | High | 7.5 | 2016-08-31 | NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 have a hardcoded qwe23622260 passwo… |
CVE-2016-5676 | High | 7.5 | 2016-08-31 | cgi-bin/cgi_system in NUUO NVRmini 2 1.7.5 through 2.x, NUUO NVRsolo 1.7.5 through 2.x, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote att… |
CVE-2016-5675 | Critical | 9.8 | 2016-08-31 | handle_daylightsaving.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, NUUO Crystal 2.2.1 through 3.2.0, and NETGEAR ReadyNAS Surve… |
CVE-2016-5674 | Critical | 9.8 | 2016-08-31 | __debugging_center_utils___.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.7.5 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1… |