CVE-2016-5677
HighSummary
NUUO NVRmini 2 versions 1.7.5 through 3.0.0, NUUO NVRsolo versions 1.0.0 through 3.0.0, and NETGEAR ReadyNAS Surveillance versions 1.1.1 through 1.4.1 have a hardcoded password qwe23622260 for the nuuoeng account, allowing remote attackers to obtain sensitive information via an __nvr_status___.php request.
Risk Assessment
Exploitation of this vulnerability may lead to the disclosure of confidential data, posing a serious threat to the security of the organization's systems and data.
Recommendation
It is recommended to change the default password for the nuuoeng account and update the software to the latest version to minimize risk.
Other vulnerabilities in NUUO NVRmini 2, NUUO NVRsolo, NETGEAR ReadyNAS Surveillance
See all- CVE-2016-5676High
In NUUO NVRmini 2 versions 1.7.5 through 2.x, NUUO NVRsolo versions 1.7.5 through 2.x, and NETGEAR ReadyNAS Surveillance versions 1.1.1 through 1.4.1, a vulnerability allows remote attackers to reset the administrator password via a cmd=loaddefconfig action.
- CVE-2016-5674Critical
__debugging_center_utils___.php in NUUO NVRmini 2 versions 1.7.5 through 3.0.0, NUUO NVRsolo versions 1.7.5 through 3.0.0, and NETGEAR ReadyNAS Surveillance versions 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the log parameter.
Original NVD description (English source)
NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 have a hardcoded qwe23622260 password for the nuuoeng account, which allows remote attackers to obtain sensitive information via an __nvr_status___.php request.