CVE-2016-5674: NUUO NVR and NETGEAR ReadyNAS Surveillance PHP code execution via log parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with a public exploit and near-maximum EPSS probability on internet-exposed surveillance and storage devices.

What it is

The __debugging_center_utils___.php script in NUUO NVRmini 2, NVRsolo and NETGEAR ReadyNAS Surveillance fails to validate the log parameter, allowing remote attackers to inject and execute arbitrary PHP code. Because the endpoint is network-reachable and needs no credentials, any exposed device is at risk of full compromise.

Impact

An unauthenticated attacker gains arbitrary PHP code execution on the device, which typically means full control of the NVR or NAS, including stored video, credentials and any data it can reach.

Attack surface

Reached over the network through the __debugging_center_utils___.php endpoint; the CVSS vector shows no privileges and no user interaction required, so the request can be sent directly to the web interface.

Exploitation

A public Exploit-DB entry (40200) exists, and EPSS is 0.9461 (99.85th percentile), indicating high likelihood of exploitation; the CVE is not listed in CISA KEV.

What to do

• Apply the vendor fix or the CERT/CC-recommended update for NUUO NVRmini 2, NVRsolo and NETGEAR ReadyNAS Surveillance; if no patch is available, retire or replace the affected device.
• Remove or block access to __debugging_center_utils___.php and other debugging endpoints at the web server or reverse proxy.
• Never expose the device management interface to the internet; restrict it to a dedicated management VLAN with allowlisted source addresses.
• Rotate credentials and review stored data on any device that may have been exposed, since code execution implies full device compromise.

Detection

• Search web logs for requests to __debugging_center_utils___.php, especially with a log parameter containing PHP tags or function calls.
• Alert on unexpected PHP file creation or modification in the device webroot and on outbound connections from the NVR/NAS to unfamiliar hosts.
• Monitor for new or altered admin accounts, cron entries or startup scripts on the affected appliances.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.