Dec 18, 2024
4 new incidents, 0 with updates.
Started
- ClosedCriticalNo patch yet
NUUO NVRmini Devices OS Command Injection
NUUO NVRmini devices contain an OS command injection vulnerability. This vulnerability allows remote command execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command. Added to the CISA KEV catalog on 2024-12-18. CVE-2018-14933 was assigned before 2024; the KEV listing came in 2024.
NUUO NVRmini DevicesClosed Dec 18, 2024
- ClosedCriticalNo patch yet
NUUO NVRmini2 Devices Missing Authentication
NUUO NVRmini2 devices contain a missing authentication vulnerability that allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users. Added to the CISA KEV catalog on 2024-12-18. CVE-2022-23227 was assigned before 2024; the KEV listing came in 2024.
NUUO NVRmini2 DevicesClosed Dec 18, 2024
- ClosedCriticalPartly patched
Reolink RLC-410W IP Camera OS Command Injection
Reolink RLC-410W IP cameras contain an authenticated OS command injection vulnerability in the device network settings functionality. Added to the CISA KEV catalog on 2024-12-18. CVE-2021-40407 was assigned before 2024; the KEV listing came in 2024.
Reolink RLC-410W IP CameraClosed Dec 18, 2024
- ClosedHighPartly patched
Reolink Multiple IP Cameras OS Command Injection
Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W IP cameras contain an authenticated OS command injection vulnerability. This vulnerability allows an authenticated admin to use the "TestEmail" functionality to inject and run OS commands as root. Added to the CISA KEV catalog on 2024-12-18. CVE-2019-11001 was assigned before 2024; the KEV listing came in 2024.
Reolink Multiple IP CamerasClosed Dec 18, 2024
