Evil-DB LogoEvil-DB
← All CVEs

CVE-2016-5677

high · 7.5

NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 have a hardcoded qwe23622260 password for the nuuoeng account, which allows remote attackers to obtain sensitive information via an __nvr_status___.php request.

7.5
CVSS
12.0%
EPSS (exploit prob.)
96th
EPSS percentile
2016-08-31
Published

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-200

Affected products

VendorProductAffected versions
netgearreadynas_surveillance1.1.1
netgearreadynas_surveillance1.1.2
netgearreadynas_surveillance1.2.0.4
netgearreadynas_surveillance1.3.2.4
netgearreadynas_surveillance1.3.2.14
netgearreadynas_surveillance1.4.0
netgearreadynas_surveillance1.4.1
netgearreadynas_surveillance1.4.2
nuuonvrmini_21.7.5
nuuonvrmini_21.7.6
nuuonvrmini_22.0.0
nuuonvrmini_22.2.1
nuuonvrmini_23.0.0
nuuonvrsolo1.0.0
nuuonvrsolo1.0.1
nuuonvrsolo1.1.0
nuuonvrsolo1.1.0.117
nuuonvrsolo1.1.1
nuuonvrsolo1.1.2
nuuonvrsolo1.2.0
nuuonvrsolo1.3.0
nuuonvrsolo1.75
nuuonvrsolo2.0.0
nuuonvrsolo2.0.1
nuuonvrsolo2.1.5
nuuonvrsolo2.2.2
nuuonvrsolo2.3
nuuonvrsolo2.3.1.20
nuuonvrsolo2.3.7.9
nuuonvrsolo2.3.7.10
nuuonvrsolo2.3.9.6
nuuonvrsolo3.0.0

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2016-5677