https://pwn.watch/t/nvr Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Wed, 18 Dec 2024 00:00:00 GMT https://pwn.watch/i/nuuo-nvrmini-devices-cve-2018-14933 https://pwn.watch/i/nuuo-nvrmini-devices-cve-2018-14933 Wed, 18 Dec 2024 00:00:00 GMT critical <p>NUUO NVRmini devices contain an OS command injection vulnerability. This vulnerability allows remote command execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command. Added to the CISA KEV catalog on 2024-12-18. CVE-2018-14933 was assigned before 2024; the KEV listing came in 2024.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> unpatched · <strong>Fixed in:</strong> No fix: CISA says the product is end-of-life and should be retired</p> <p><strong>Latest updates:</strong></p><ul><li>2024-12-18: CISA added CVE-2018-14933 to the KEV catalog (federal deadline 2025-01-08) (<a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2018-14933</p> https://pwn.watch/i/nuuo-nvrmini2-devices-cve-2022-23227 https://pwn.watch/i/nuuo-nvrmini2-devices-cve-2022-23227 Wed, 18 Dec 2024 00:00:00 GMT critical <p>NUUO NVRmini2 devices contain a missing authentication vulnerability that allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users. Added to the CISA KEV catalog on 2024-12-18. CVE-2022-23227 was assigned before 2024; the KEV listing came in 2024.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> unpatched · <strong>Fixed in:</strong> No fix: CISA says the product is end-of-life and should be retired</p> <p><strong>Latest updates:</strong></p><ul><li>2024-12-18: CISA added CVE-2022-23227 to the KEV catalog (federal deadline 2025-01-08) (<a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2022-23227</p>