CVE-2018-18982: NUUO CMS web server SQL injection allows arbitrary code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 8.8 with network reachability, low privileges, and public exploit code, though no KEV listing or confirmed in-the-wild use is recorded.

What it is

NUUO CMS versions 3.3 and prior contain a SQL injection flaw in the web server application, where arbitrary SQL characters can be injected into an executing statement. The vendor advisory and public exploit references confirm the issue, and the CVSS vector indicates high confidentiality, integrity, and availability impact. Because the product is a video management system, compromise can expose camera feeds and stored recordings.

Impact

An authenticated attacker can execute arbitrary SQL and, per the description, achieve arbitrary code execution on the CMS host. This gives control over the video management server and the data it handles.

Attack surface

The flaw is reachable over the network through the NUUO CMS web server application. The CVSS vector requires low privileges (PR:L) and no user interaction (UI:N), so an attacker needs some valid account but no victim action.

Exploitation

A public exploit exists (Exploit-DB 46449) and EPSS is high at 0.60791 (99th percentile), but the CVE is not listed in CISA KEV, so no confirmed in-the-wild exploitation is recorded here.

What to do

• Upgrade NUUO CMS to a version later than 3.3 if the vendor provides one; the record does not list a fixed version, so confirm with NUUO support.
• If upgrade is not possible, isolate the CMS web interface from untrusted networks and restrict access to trusted management hosts.
• Enforce least privilege on CMS accounts and remove or disable unused accounts to reduce the low-privilege foothold the vector requires.
• Apply input validation and parameterized queries at the web application layer if custom integration code is in use.
• Monitor the ICS-CERT advisory ICSA-18-284-02 for vendor remediation guidance.

Detection

• Review web server and application logs for SQL metacharacters (quotes, semicolons, UNION, stacked queries) in requests to NUUO CMS endpoints.
• Alert on unexpected child processes or command execution spawned by the CMS web server process.
• Monitor for anomalous database queries or errors originating from the CMS application.
• Use the public Exploit-DB 46449 proof-of-concept to build signatures for known injection patterns against this product.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.