Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2016-5675

CWE-20 — Improper Input Validation4 documents4 sources
Severity
9.8CRITICAL
EPSS
73.1%
top 1.21%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
4
Netgear Readynas SurveillanceNuuo CrystalNuuo Nvrmini 2+1 more
Timeline
PublishedAug 31
Latest updateMay 17

Description

handle_daylightsaving.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, NUUO Crystal 2.2.1 through 3.2.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the NTPServer parameter.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages4 packages

▶NVDnuuo/crystal4 versions+3
▶NVDnuuo/nvrsolo19 versions+18
▶NVDnuuo/nvrmini_25 versions+4

🔴Vulnerability Details

2
GHSA
GHSA-h33j-gch2-5c9c: handle_daylightsaving↗2022-05-17
▶
CVEList
CVE-2016-5675: handle_daylightsaving↗2016-08-31
▶

💥Exploits & PoCs

1
Exploit-DB
NUUO NVRmini2 / NVRsolo / Crystal Devices / NETGEAR ReadyNAS Surveillance Application - Multiple Vulnerabilities↗2016-08-05
▶