CVE-2016-5675: NUUO and NETGEAR NVR software PHP code execution via NTPServer parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or interaction required, public exploit code, and a very high EPSS score make this an urgent remote code execution risk on internet- or network-exposed NVR appliances.

What it is

handle_daylightsaving.php in NUUO NVRmini 2, NVRsolo, Crystal, and NETGEAR ReadyNAS Surveillance fails to validate the NTPServer parameter, allowing injection of arbitrary PHP code. Because the affected devices are network video recorders, successful exploitation gives an attacker code execution on a system that often sits on the camera network and holds recorded footage.

Impact

An attacker gains remote arbitrary PHP code execution with the privileges of the web server, which on these appliances typically means full control of the device and access to stored video and configuration data.

Attack surface

Reachable over the network through the web interface's handle_daylightsaving.php endpoint; the CVSS vector shows no privileges or user interaction required, so the request can be sent directly to the exposed service.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.70877, 99.4th percentile) and a public Exploit-DB entry (40200) exists, indicating exploit code is available and exploitation is plausible.

What to do

• Apply the vendor firmware updates for NUUO NVRmini 2, NVRsolo, Crystal and NETGEAR ReadyNAS Surveillance that address the NTPServer input handling.
• If no patch is available for a given model, isolate the NVR web interface from untrusted networks and restrict access to a management VLAN.
• Block or filter requests to handle_daylightsaving.php from untrusted sources at the perimeter or reverse proxy.
• Replace end-of-life NVR models that no longer receive security fixes.
• Audit NVR web server accounts and disable unused remote access features.

Detection

• Monitor web logs for requests to handle_daylightsaving.php, especially with unusual or encoded NTPServer parameter values.
• Alert on PHP process spawning unexpected child processes or writing files under the web root on NVR hosts.
• Watch for outbound connections from NVR devices to unfamiliar hosts, which may indicate post-exploitation activity.
• Review NVR configuration changes and new administrative accounts for signs of tampering.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.