CVE-2018-15716

published 2018-11-30

CVE-2018-15716: NUUO NVRMini2 version 3.9.1 is vulnerable to authenticated remote command injection. An attacker can send crafted requests to upgrade_handle.php to execute OS…

Priority P2 73 high 8.8 CVSS 3.0

AV N AC L PR L UI N S U C H I H A H

ITW EXPLOIT

NUUO NVRMini2 version 3.9.1 is vulnerable to authenticated remote command injection. An attacker can send crafted requests to upgrade_handle.php to execute OS commands as root.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
nuuo	nuuo_nvrmini2	—	—
nuuo	nvrmini2_firmware	—	—

Detection & IOCs extracted from sources · hover to see the quote

path upgrade_handle.php↗

url upgrade_handle.php?cmd=writeuploaddir↗

url _handle.php?cmd=getupgradinginfo

snort

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Nuuo NVR RCE Attempt (CVE-2018-15716)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"_handle.php?cmd=getupgradinginfo"; fast_pattern; endswith; classtype:attempted-admin; sid:2026982; rev:3; metadata:created_at 2019_02_26, cve CVE_2018_15716, deployment Perimeter, performance_impact Low, confidence Medium, signature_severity Major, updated_at 2020_09_16;)

• · Exploitation requires prior authentication — the attacker must supply valid credentials to obtain a session cookie before sending the command injection payload. ↗
• · The exploit's primitive bash command parser only supports splitting a command on the first space where the next character is not '-', meaning multi-parameter commands with flags may not be handled correctly by the PoC. ↗

CVSS provenance

nvd v3.0 8.8 HIGH CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 9.0 CRITICAL AV:N/AC:L/Au:S/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78