CVE-2018-14933

What is NUUO NVRmini?

NUUO NVRmini devices are network video recorders (NVRs) used to record, store, and manage footage from IP security cameras in commercial and residential surveillance deployments. Like most NVR appliances, they run a web management interface for remote configuration and playback, and they are frequently exposed to the internet so operators can view live/recorded footage remotely — making a remote code execution flaw in the management interface a direct path to compromising physical security camera infrastructure.

Overview

CVE-2018-14933 is an OS command injection vulnerability in NUUO NVRmini devices reachable via the uploaddir parameter of a writeuploaddir command in the web management interface. By supplying shell metacharacters in this parameter, a remote attacker can execute arbitrary operating system commands on the device.

Technical Details

The flaw (CWE-78, OS Command Injection) arises because the uploaddir parameter value is passed into a system-level command (used to configure or validate the upload directory path) without sanitizing shell metacharacters such as semicolons, backticks, or pipes. This allows an attacker to append and execute arbitrary commands alongside the legitimate directory-configuration command, typically requiring only a crafted HTTP request to the vulnerable endpoint.

Discovery

No specific named third-party researcher disclosure is confidently documented for this particular CVE; it was addressed through NUUO's advisory and support channels, though the product line has since reached formal end-of-life.

Exploitation Context

CISA's KEV entry confirms this vulnerability has been exploited in the wild. NUUO NVR products have a documented history of being targeted by IoT botnet campaigns (the NVRmini/NVRmini2 line was previously implicated in other high-profile flaws exploited by botnet operators), and internet-exposed video surveillance recorders are an attractive target both for opportunistic botnet recruitment and for attackers seeking access to live camera feeds.

Remediation

1. Because NUUO has formally declared the NVRmini 2 and NVRsolo series end-of-life (per their 2023 EOL notice), plan to replace affected hardware — no further vendor patches should be expected.
2. If replacement is not immediately possible, remove the device from direct internet exposure and restrict access to a trusted internal network or VPN.
3. Disable or restrict access to the web management interface's upload-directory configuration functionality where not actively needed.
4. Segment surveillance/NVR networks from general corporate or home networks to limit lateral movement if a device is compromised.
5. Monitor NVR devices for unexpected outbound connections or configuration changes that could indicate command injection exploitation.