CVE-2018-14933

critical · 9.8Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

Added 2024-12-18Remediation due 2025-01-08

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.

9.8

CVSS

94.9%

EPSS (exploit prob.)

100th

EPSS percentile

2018-08-04

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-78

Affected products

Vendor	Product	Affected versions
nuuo	nvrmini_firmware	2016
nuuo	nvrmini	all versions

Check a specific version with /api/v1/cve/match.

References

https://www.exploit-db.com/exploits/45070/
https://www.exploit-db.com/exploits/46340/
https://www.exploit-db.com/exploits/45070/
https://www.exploit-db.com/exploits/46340/
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-14933

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2018-14933