CVE-2018-14933 — VulnIntel

CVE-2018-14933

CRITICAL

KEV

Exploit

upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.

설명

upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.

Score Summary

CVSS Score: 9.8
Version: 3.1
VPI: 100
Why this VPI (explainable, experimental)
VPI breakdown
Impact 98.00
Exploitation signal(KEV listed) ×1.50
VPI 100.00
VPI formula vpi-v1
EPSS: 93.7%
(상위 99.8%)
Attack Vector: Network
Low Complexity
No Privileges
No User Interaction
Scope Unchanged
High Confidentiality Impact
High Integrity Impact
High Availability Impact

Details

Published: 08/04/2018(8 years ago)
Modified: 11/07/2025(9 months ago)
Source: KEV, NVD
Products: 2

CISA KEV Listing

Vendor / Project: NUUO
Product: NVRmini Devices

Date Added: 12/18/2024
Due Date: 01/08/2025Overdue 560d

Required Action

The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

Vulnerability Lifecycle

NVDPublished08/04/2018
CISA KEVKEV Listed12/18/2024
CISA KEV

Score Comparison by Source

Source	CVSS Version	Base Score	Severity	Vector String	Assessment Date
NVDNIST	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	04/20/2026
NVDNIST	2.0	10.0

CWE Weakness Classification

CWE-78
NVD
Secondary

References (4)

NVD
Exploit
https://www.exploit-db.com/exploits/45070/
NVD
Exploit
https://www.exploit-db.com/exploits/46340/
NVD

Affected Products (2)

Impact	98.00
Exploitation signal(KEV listed)	×1.50
VPI	100.00