← Vulnerability feed

Vulnerability record · CVE-2016-5677 · published 31 August 2016

CVE-2016-5677: Netgear readynas surveillance information exposure vulnerability

Netgear · Readynas Surveillance

NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 have a hardcoded qwe23622260 password for the nuuoeng account, which allows remote attackers to obtain sensitive information via an __nvr_status___.php request.

7.5 CVSS 3.0 High EPSS 12% · top 4.0% CWE-200 · Information exposure
7.5CVSS 3.0 base score, v2 5.0
12%EPSS exploitation probability, 30 days
NoNot in CISA KEV
3Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 have a hardcoded qwe23622260 password for the nuuoeng account, which allows remote attackers to obtain sensitive information via an __nvr_status___.php request.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.kb.cert.org/vuls/id/856152 Third Party AdvisoryUS Government Resource
http://www.securityfocus.com/bid/92318
https://www.exploit-db.com/exploits/40200/
http://www.kb.cert.org/vuls/id/856152 Third Party AdvisoryUS Government Resource
http://www.securityfocus.com/bid/92318
https://www.exploit-db.com/exploits/40200/

Track CVE-2016-5677 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2016-5678Nuuo nvrmini 2 hard-coded credentials vulnerabilityNUUO NVRmini 2 1.0.0 through 3.0.0 and NUUO NVRsolo 1.0.0 through 3.0.0 have hardcoded root credentials, which allows remote attackers to obtain admi…EPSS 8.7%9.8CVE-2016-5675NUUO and NETGEAR NVR software PHP code execution via NTPServer parameterhandle_daylightsaving.php in NUUO NVRmini 2, NVRsolo, Crystal, and NETGEAR ReadyNAS Surveillance fails to validate the NTPServer parameter, allowing …EPSS 71%analysed9.8CVE-2016-5674NUUO NVR and NETGEAR ReadyNAS Surveillance PHP code execution via log parameterThe __debugging_center_utils___.php script in NUUO NVRmini 2, NVRsolo and NETGEAR ReadyNAS Surveillance fails to validate the log parameter, allowing…EPSS 95%analysed8.8CVE-2016-11056Netgear readynas surveillance vulnerabilityCertain NETGEAR devices are affected by anonymous root access. This affects ReadyNAS Surveillance 1.1.1-3-armel and earlier and ReadyNAS Surveillance…EPSS 1.6%8.8CVE-2016-5680Nuuo nvrmini 2 memory buffer overflow vulnerabilityStack-based buffer overflow in cgi-bin/cgi_main in NUUO NVRmini 2 1.7.6 through 3.0.0 and NETGEAR ReadyNAS Surveillance 1.1.2 allows remote authentic…EPSS 17%8.8CVE-2016-5679Nuuo nvrmini 2 os command injection vulnerabilitycgi-bin/cgi_main in NUUO NVRmini 2 1.7.6 through 3.0.0 and NETGEAR ReadyNAS Surveillance 1.1.2 allows remote authenticated users to execute arbitrary…EPSS 14%8.0CVE-2017-18861Netgear readynas surveillance cross-site request forgery vulnerabilityCertain NETGEAR devices are affected by CSRF. This affects ReadyNAS Surveillance 1.4.3-15-x86 and earlier and ReadyNAS Surveillance 1.1.4-5-ARM and e…EPSS 0.38%7.5CVE-2016-5676NUUO NVR and NETGEAR ReadyNAS Surveillance admin password reset via improper authorizationThe cgi-bin/cgi_system endpoint in NUUO NVRmini 2, NVRsolo and NETGEAR ReadyNAS Surveillance accepts a cmd=loaddefconfig action that resets the admin…EPSS 54%analysed

Source: NIST National Vulnerability Database (record CVE-2016-5677), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.