CVE-2018-14933: NUUO NVRmini upgrade_handle.php OS command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated remote command execution with a CVSS of 9.8, KEV listing and near-maximum EPSS makes this an urgent exposure for any internet-facing NVRmini device.

What it is

NUUO NVRmini devices contain an OS command injection flaw in upgrade_handle.php, where shell metacharacters in the uploaddir parameter of a writeuploaddir command are passed to the shell without sanitization. It is remotely reachable without authentication and is listed in CISA KEV, making it a high-value target for internet-facing NVRs.

Impact

An unauthenticated attacker can execute arbitrary shell commands on the device, gaining full control of the NVR and any data or network access it holds.

Attack surface

The flaw is reached over the network via HTTP requests to upgrade_handle.php, requiring no authentication and no user interaction per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

CISA added this to KEV on 2024-12-18 with a 2025-01-08 remediation due date, and public Exploit-DB entries exist; EPSS is 0.94884 (99.856th percentile), indicating very high likelihood of exploitation.

What to do

• Discontinue use of NUUO NVRmini devices, which CISA identifies as end-of-life/end-of-service with no vendor fix.
• If the device cannot be removed immediately, isolate it on a segmented network with no internet exposure and restrict management access to trusted hosts.
• Block or filter external access to upgrade_handle.php and the device's web management interface at the perimeter.
• Monitor for and replace the device with a supported NVR product as the permanent remediation.

Detection

• Inspect web server or proxy logs for requests to upgrade_handle.php with shell metacharacters (;, |, $(), backticks) in the uploaddir parameter.
• Alert on unexpected outbound connections or process execution from NVR devices, which may indicate command injection success.
• Hunt for anomalous child processes spawned by the web server process on the NVR host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.