CVE-2018-11523

published 2018-05-29

CVE-2018-11523: upload.php on NUUO NVRmini 2 devices allows Arbitrary File Upload, such as upload of .php files.

Priority P2 72 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

upload.php on NUUO NVRmini 2 devices allows Arbitrary File Upload, such as upload of .php files.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
nuuo	nvrmini_2_firmware	<= 3.6.5	—

Detection & IOCs extracted from sources · hover to see the quote

path /upload.php↗

filename nuuonvr.php↗

url http://192.168.10.1/nuuonvr.php↗

command ?php phpinfo();@unlink(__FILE__);?↗

• → Detect multipart/form-data POST requests to /upload.php with a filename parameter containing a .php extension, indicating attempted webshell upload. ↗
• → Alert on multipart form-data uploads where the Content-Disposition filename field ends in .php — no server-side filtering is present on the target. ↗
• → Monitor for GET requests to newly created .php files in the web root immediately following a POST to /upload.php, as the exploit pattern verifies execution by fetching the uploaded file. ↗
• → Use the Google dork 'intitle:NUUO Network Video Recorder Login' to identify exposed NUUO NVR devices on the internet that may be targeted. ↗

• · The vulnerability affects ALL firmware versions of NUUO NVRmini2 and NVRsolo — there is no version-specific scope, meaning any deployed device is potentially vulnerable. ↗
• · The upload endpoint performs no filtering whatsoever on uploaded file types, allowing direct .php webshell upload to the web root. ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434