CyberRota Analysis
AI-GeneratedNUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read due to improper handling of user-supplied URLs in the up.php script, allowing attackers to read sensitive files from the server. The exploitation of this vulnerability does not require authentication, posing a significant risk to the confidentiality of the system. Organizations using this version of the NUUO Network Video Recorder should prioritize remediation to prevent unauthorized access to sensitive data.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted by the user via POST is received, and fopen() is used to open the URL in binary read-only mode. The content is then written to the /tmp/ directory, with the filename derived from basename() of the URL. This operation requires no authentication.