upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir parameter for a writeu…

published 2018-08-04 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-6815

cvss: 9.8; version 3.1, CNA
cisa kev: Exploited; added 2024-12-18
epss: 94.8%; EPSS 94.8% chance of exploitation in 30 days, percentile 99.8%
public exploits: 2; Metasploit, Exploit-DB, plus a Nuclei check

upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.

Patch / fix

cisa required action The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

Timeline

2018-08-04 First public exploit (Metasploit exploit/multi/http/nuuo_nvrmini_upgrade_rce)
2018-08-04 Published
2024-12-18 Added to CISA KEV
2024-12-21 CISA SSVC: exploitation active
2025-01-08 CISA patch deadline

Known exploited

Added: 22 mo ago (2024-12-18)
Patch by: 2025-01-08 (22 mo ago)
Ransomware: Not known
Required action: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
Vendor, product: NUUO, NVRmini Devices
CISA name: NUUO NVRmini Devices OS Command Injection Vulnerability

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: yes
Technical impact: total
Assessed: 22 mo ago (2024-12-21)

Exploit prediction

94.76% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Metasploit exploit/multi/http/nuuo_nvrmini_upgrade_rce NUUO NVRmini upgrade_handle.php Remote Command Execution metasploit exploit, excellent rank, 2018-08-04
EDB-46340 NUUO NVRmini - upgrade_handle.php Remote Command Execution (Metasploit) remote, 2019-02-11
Nuclei template NUUO NVRmini - Remote Command Execution nuclei detection template
exploit-db.com https://www.exploit-db.com/exploits/45070/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	10.0	AV:N/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness

CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

exploit-db.com /exploits/45070/
exploit, third-party-advisory, vdb-entry
exploit-db.com /exploits/46340/
exploit, third-party-advisory, vdb-entry
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-14933
government-resource, us-government-resource

Sources

CVE List CVE-2018-14933
NVD CVE-2018-14933

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary