CVE-2018-14933

Timeline

Detection, updates, and resolution for this record.

1. Aug 4, 2018 · Catalog

   Detected

   NUUO NVRmini devices contain an OS command injection vulnerability. This vulnerability allows remote command execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.

2. Dec 18, 2024 · CISA KEV

   Known exploited

   The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

3. Jan 8, 2025 · CISA KEV

   Remediation due

   The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

4. Jun 16, 2026 · Catalog

   Updated

   NUUO NVRmini devices contain an OS command injection vulnerability. This vulnerability allows remote command execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.

Affected

• cpe nuuo/nvrmini firmware2016
• vendor NUUO NVRmini Devicesversion unspecified

Sources

• CISA KEVCVE-2018-14933

  NUUO NVRmini devices contain an OS command injection vulnerability. This vulnerability allows remote command execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.

  cisa.gov
• CVE.orgCVE-2018-14933

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2018-14933

  30-day exploitation probability 94.8%

  first.org
• Exploit Database46340

  Public archive entry. The exploit body is not stored here.

  exploit-db.com
• Metasploit Modulesexploit_multi/http/nuuo_nvrmini_upgrade_rce

  Public module reference (excellent). Module source is not copied into this catalog.

  rapid7.com
• NIST NVDCVE-2018-14933

  upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.

  nvd.nist.gov

References

• CISA note · nuuo.com
• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov
• Exploit · exploit-db.com
• Exploit · exploit-db.com