CVE-2025-1338

NUUO Camera devices running builds up to 20250203 contain a critical command injection flaw (CWE-74/CWE-77) in the print_file function of /handle_config.php. The log parameter passed to this endpoint is not properly sanitized, so an unauthenticated remote attacker can submit crafted input that is executed as operating-system commands on the device. Successful exploitation can give the attacker control of the surveillance appliance, access to camera streams and recorded footage, and a foothold to pivot into the network it monitors. Any NUUO Camera deployment with a build dated on or before 2025-02-03 is affected, and the vendor was notified but has not responded. Exploit details have been publicly disclosed, the flaw is not yet in CISA KEV, and there are no confirmed reports of in-the-wild exploitation, though EPSS assigns a high (~51%) probability of exploitation within 30 days.

What to do: Check NUUO's website and support channels for a patched release newer than build 20250203 — the vendor was contacted but did not respond, so a fix may lag. Until a patch is available, restrict internet exposure of the device's web interface (allow only trusted management networks or place it behind a VPN), and use a WAF or reverse proxy to validate or restrict the log parameter on /handle_config.php. Review device and perimeter logs for unexpected command execution or connections to the web interface from unknown sources.