CVE-2018-14933

CVE-2018-14933 is an unauthenticated OS command injection flaw (CWE-78) in the upgrade_handle.php script of NUUO NVRmini network video recorder firmware, in which shell metacharacters passed in the 'uploaddir' parameter of a 'writeuploaddir' command are not sanitized. An attacker who sends a crafted HTTP request to this endpoint gains remote command execution on the appliance with no credentials and no user interaction, consistent with the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N. Compromise of the NVR allows an attacker to take over the surveillance appliance, pivot into attached camera networks and connected corporate networks, and stage further attacks such as data theft or ransomware. All organizations running NUUO NVRmini appliances are affected; CISA notes the product is end-of-life/end-of-service, and no version-specific fix range is documented in the available data. Exploitation is confirmed: CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2024-12-18, two public PoC exploits exist on Exploit-DB, and EPSS assigns a 94.9% probability of exploitation within 30 days.

What to do: Per CISA's required action, discontinue use of the end-of-life/end-of-service NUUO NVRmini product and plan replacement of these appliances; in the interim, remove them from direct internet exposure, restrict management access to trusted networks, and apply any final firmware updates the vendor offers. Check device and firewall logs for unauthenticated HTTP requests to upgrade_handle.php using the writeuploaddir command with shell metacharacters, and treat any hits as potential compromise.