CVE-2018-14933VulnerabilityPublished 12/18/2024Updated 10/24/2026
CVE-2018-14933: NUUO NVRmini Devices OS Command Injection Vulnerability
Affects NUUO NVRmini DevicesSource CISA KEV
Severity
HighNo CVSS score published yet
- Exploitation
Actively exploited – in CISA KEV since 12/18/2024
- KEV deadline
- 01/08/2025
- EPSS
- 94.8% chance of exploitation in 30 days – higher than 99% of CVEs
What to do
CISA required action
The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
Description
NUUO NVRmini devices contain an OS command injection vulnerability. This vulnerability allows remote command execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.