{"id":"CVE-2018-14933","kind":"vulnerability","aliases":["CVE-2018-14933"],"related":[],"title":"nuuo nvrmini firmware: upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir…","description":"NUUO NVRmini devices contain an OS command injection vulnerability. This vulnerability allows remote command execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.\n\nCISA required action: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.","summary":"NUUO NVRmini network video recorders contain an OS command injection flaw in the uploaddir parameter of the writeuploaddir command. An unauthenticated attacker can run arbitrary operating system commands on the device by sending shell metacharacters in that parameter.","severity":"critical","cvss":10.0,"epss":null,"exploited":true,"exploited_at":"2024-12-18T00:00:00+00:00","products":[{"name":"NUUO NVRmini Devices","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"nuuo nvrmini firmware","fixed":[],"affected":"= 2016","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["embedded-linux","exploited","infrastructure","iot","nuuo","nvrmini","video-surveillance"],"not_affected_if":["no-nuuo-nvrmini-devices"],"how_to_check":"Identify any NUUO NVRmini device on the network; check the model and firmware against the vendor advisory (not in sources).","fix":"Discontinue use of the product, since CISA states it is end-of-life and end-of-service; replace it with a supported device.\nUnisolated devices should be removed from internet exposure until replaced.","status":"open","published_at":"2018-08-04T19:29:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:56:00+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:56:00Z","model":"claude-haiku-5-5","output":{"fix":"Discontinue use of the product, since CISA states it is end-of-life and end-of-service; replace it with a supported device.\nUnisolated devices should be removed from internet exposure until replaced.","reach":"network","impact":"high","summary":"NUUO NVRmini network video recorders contain an OS command injection flaw in the uploaddir parameter of the writeuploaddir command. An unauthenticated attacker can run arbitrary operating system commands on the device by sending shell metacharacters in that parameter.","category":"infrastructure","who_cares":["nuuo","nvrmini","iot","video-surveillance","embedded-linux"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary OS commands on the recorder, potentially taking full control.","analyst_note":"Confirm affected firmware versions and whether the writeuploaddir endpoint requires authentication; check the NUUO advisory and the CVE record.","how_to_check":"Identify any NUUO NVRmini device on the network; check the model and firmware against the vendor advisory (not in sources).\nunknown\nunknown","needs_analyst":true,"not_affected_if":["no-nuuo-nvrmini-devices"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000515,"input_tokens":2846,"output_tokens":460,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-14933':21A,24A '-2018':20A,23A 'action':108C 'allow':9A,91C 'and/or':118C 'arbitrari':66B 'attack':63B 'cisa':106C 'command':11A,50B,60B,69B,86C,93C,105C 'contain':47B,83C 'cve':19A,22A 'devic':8A,72B,82C 'devices':27A 'discontinu':126C 'embed':32B 'embedded-linux':31B 'end':114C,120C 'end-of-lif':113C 'end-of-servic':119C 'eo':123C 'eol':117C 'execut':12A,94C 'exploit':34B 'firmwar':3A 'firmware':30A 'flaw':52B 'impact':110C 'infrastructur':35B 'inject':51B,87C 'iot':36B 'life':116C 'linux':33B 'metacharact':15A,76B,97C 'network':44B 'nuuo':1A,6A,25A,28A,37B,42B,80C 'nvrmini':2A,7A,26A,29A,38B,43B,81C 'oper':67B 'os':49B,85C 'paramet':56B,79B,101C 'product':111C,130C 'record':46B 'remot':10A,92C 'requir':107C 'run':65B 'send':74B 'servic':122C 'shell':14A,75B,96C 'surveil':41B 'system':68B 'unauthent':62B 'upgrade_handle.php':4A 'uploaddir':18A,55B,100C 'user':124C 'util':127C 'via':13A,95C 'video':40B,45B 'video-surveil':39B 'vulner':88C,90C 'writeuploaddir':59B,104C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2018-08-04T19:29:00+00:00","kev":{"dateAdded":"2024-12-18","dueDate":"2025-01-08","requiredAction":"The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2018-14933","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-14933","severity":null,"published_at":"2024-12-18T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T14:39:38+00:00","note":null},{"source":"nvd","external_id":"CVE-2018-14933","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-14933","severity":null,"published_at":"2018-08-04T19:29:00+00:00","modified_at":"2026-06-17T01:41:54+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}