CVE-2018-14933
NUUO NVRmini Devices OS Command Injection Vulnerability
Description
CVE-2018-14933 is a critical remote command execution vulnerability in NUUO NVRmini network video recorder devices. The flaw exists in the upgrade_handle.php script, which allows unauthenticated attackers to inject and execute arbitrary shell commands via metacharacters in the uploaddir parameter when processing a writeuploaddir command. With a CVSS v3.1 base score of 9.8 and an extraordinary EPSS score of 93.87% at the 99.9th percentile, this is among the most exploited IoT vulnerabilities in existence. CISA has added CVE-2018-14933 to the Known Exploited Vulnerabilities catalog with a remediation deadline of January 8, 2025, and multiple public exploits including Exploit-DB entries confirm widespread weaponization.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| nuuo | nvrmini firmware | 2016 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.exploit-db.com/exploits/45070/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/46340/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-14933(US Government Resource)
Weakness Type
OS Command Injection via Firmware Upgrade Handler
CVE-2018-14933 is an OS command injection vulnerability in the upgrade_handle.php script on NUUO NVRmini devices. The vulnerability occurs when the script processes a writeuploaddir command, where the uploaddir parameter is directly incorporated into an operating system command without any input validation or sanitization. An attacker can inject shell metacharacters into this parameter, causing the underlying Linux operating system to execute arbitrary commands. The vulnerability requires no authentication, making it directly exploitable by any attacker with network access to the device's web interface. This represents a complete failure of input validation at a critical trust boundary between the web application and the operating system. Learn more about OS command injection at CWE-78.
Impact Analysis
The impact of CVE-2018-14933 is maximum across all dimensions of the CIA triad. Confidentiality is fully compromised because unauthenticated command execution on the NVR grants immediate access to all surveillance video recordings, camera configurations, network credentials, and any data stored on the device. NVRmini devices serve as centralized recording hubs for multiple IP cameras, so a single compromise exposes an organization's entire surveillance infrastructure.
Integrity faces catastrophic impact as the attacker can modify or delete surveillance recordings (potentially destroying forensic evidence), alter device configurations, install persistent backdoors, and fully repurpose the NVR as an attack platform. The ability to tamper with surveillance footage has severe implications for organizations relying on video evidence for security investigations or regulatory compliance.
Availability is maximally threatened since command execution enables the attacker to disable recording, shut down all connected cameras, corrupt the filesystem, or brick the device entirely. The attack is network-accessible (AV:N) with low complexity (AC:L), requires no authentication (PR:N) and no user interaction (UI:N). The EPSS score of 93.87% at the 99.9th percentile places this in the top 0.1% of all vulnerabilities by exploitation likelihood, essentially indicating near-certain exploitation of any exposed instance. While CISA classifies the ransomware association as unknown, NVR devices compromised through this vulnerability have been incorporated into large botnets and used as network pivot points in broader intrusion campaigns.
Exploit Maturity
CVE-2018-14933 has maximum exploit maturity with multiple weaponized exploits freely available. Two Exploit-DB entries document the vulnerability: exploit 45070 provides the original remote command execution proof-of-concept, and exploit 46340 provides additional exploitation techniques. These publicly available exploits make the vulnerability trivially exploitable by anyone with basic technical knowledge.
CISA has confirmed active exploitation by adding it to the Known Exploited Vulnerabilities catalog. The EPSS score of 93.87% at the 99.9th percentile is among the highest of any tracked vulnerability, indicating that exposed NVRmini devices face near-certain exploitation. The vulnerability has been known since 2018 and has been actively exploited for years, giving threat actors ample time to develop and refine automated exploitation tools. IoT botnets such as Mirai variants have historically targeted vulnerabilities in NVR and IP camera devices, and the combination of zero-authentication requirement, trivial exploitation complexity, and root-level command execution makes CVE-2018-14933 an ideal candidate for mass automated exploitation. While the ransomware connection remains unclassified, the long exploitation history and botnet integration make this one of the most dangerous IoT vulnerabilities still affecting deployed devices.
Remediation
-
Immediately isolate all NUUO NVRmini devices from untrusted networks. Given the critical severity and near-certain exploitation rate, block all internet access to NVRmini management interfaces as the highest priority action. Implement firewall rules that restrict access to only authorized management stations on the local network.
-
Update NVRmini firmware if patches are available. Check NUUO support channels for firmware versions that address the command injection in upgrade_handle.php. If no patch exists for your device model, this vulnerability cannot be mitigated through configuration changes alone and device replacement should be planned.
-
Treat any internet-exposed NVRmini as compromised. Any NVRmini device that was accessible from untrusted networks while running vulnerable firmware should undergo forensic analysis. Check for web shells, unauthorized user accounts, modified system files, unexpected cron jobs, and outbound connections to unknown hosts.
-
Deploy network monitoring for exploitation indicators. Implement IDS rules to detect HTTP requests to upgrade_handle.php containing shell metacharacters in the uploaddir parameter. Monitor NVRmini devices for unusual outbound traffic, DNS queries to suspicious domains, and connections to known botnet command-and-control infrastructure.
-
Plan migration to supported NVR platforms. Given the age of this vulnerability (2018) and the pattern of critical security issues in NUUO products, organizations should evaluate migration to actively maintained NVR solutions with demonstrated security response capabilities. Continuing to operate NVRmini devices with unpatched critical RCE vulnerabilities represents an unacceptable ongoing risk.
Technical Details
CVE-2018-14933 is a critical OS command injection vulnerability in NUUO NVRmini network video recorder devices. The CVSS v3.1 vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, representing maximum practical severity for an unchanged-scope vulnerability with no authentication requirement.
The vulnerability resides in the upgrade_handle.php script, which is part of the NVRmini's firmware upgrade mechanism. When this script receives a writeuploaddir command, it processes the uploaddir parameter by incorporating its value directly into an operating system command executed through a shell. No input validation, sanitization, or escaping is applied to the uploaddir parameter before command construction.
An attacker exploits this by sending an HTTP request to upgrade_handle.php with the writeuploaddir command and an uploaddir parameter containing shell metacharacters. For instance, including a semicolon followed by arbitrary commands causes the server to execute the injected commands after processing the original upload directory instruction. Common injection payloads establish reverse shells, download and execute additional malware, or create persistent web shell access.
The commands execute with the privileges of the web server process, which on NVRmini devices runs with root or equivalent elevated permissions typical of embedded Linux systems. This grants the attacker unrestricted control over the device, including access to all stored recordings, camera management capabilities, and the ability to pivot through the device to attack other systems on the network.
The affected firmware includes the 2016 NVRmini firmware version and potentially other versions. The vulnerability has been publicly known since 2018, with multiple exploits available on Exploit-DB, yet many devices remain unpatched due to the challenges of IoT firmware management and the tendency for organizations to neglect updates on surveillance equipment.
Frequently Asked Questions
What is CVE-2018-14933?
CVE-2018-14933 is a critical remote command execution vulnerability in NUUO NVRmini network video recorder devices. The upgrade_handle.php script allows unauthenticated attackers to inject arbitrary shell commands via the uploaddir parameter, achieving root-level command execution on the device.
How likely is exploitation of CVE-2018-14933?
Exploitation is near-certain for any exposed device. The EPSS score of 93.87% at the 99.9th percentile places it among the most exploited vulnerabilities ever tracked. Multiple public exploits have been available since 2018, and automated exploitation tools actively target this flaw.
Can this vulnerability be exploited without authentication?
Yes. CVE-2018-14933 requires absolutely no authentication. Any attacker who can reach the NVRmini web interface can execute arbitrary commands as root by sending a single crafted HTTP request to upgrade_handle.php.
Should NVRmini devices be replaced rather than patched?
Given the pattern of critical vulnerabilities in NUUO NVR products and the uncertainty around patch availability for older models, replacement with actively maintained NVR solutions is strongly recommended. Organizations that cannot immediately replace devices should isolate them completely from untrusted networks.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.