CVE-2018-11523 – CVE-2018-11523 allows attackers to upload arbit... (How to Fix)

Q: What is the severity of CVE-2018-11523?

CVE-2018-11523 has a CVSS score of 9.8 (CRITICAL). CVE-2018-11523 allows attackers to upload arbitrary files, including malicious PHP scripts, to NUUO NVRmini 2 devices via upload.php. This affects all users of vulnerable NVRmini 2 devices, potentially leading to complete system compromise.

📋 TL;DR

CVE-2018-11523 allows attackers to upload arbitrary files, including malicious PHP scripts, to NUUO NVRmini 2 devices via upload.php. This affects all users of vulnerable NVRmini 2 devices, potentially leading to complete system compromise.

💻 Affected Systems

Products:

NUUO NVRmini 2

Versions: All versions prior to patch (specific version unknown)

Operating Systems: Embedded Linux

Default Config Vulnerable: ⚠️ Yes

Notes: Affects the web management interface of NVRmini 2 devices. No special configuration required.

📦 What is this software?

Nvrmini 2 Firmware by Nuuo

View all CVEs affecting Nvrmini 2 Firmware →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full system compromise with remote code execution, data theft, and device takeover for persistent access.

🟠

Likely Case

Web shell installation leading to data exfiltration, surveillance footage manipulation, and lateral movement within the network.

🟢

If Mitigated

Limited impact if file uploads are blocked at network perimeter and devices are isolated.

🌐 Internet-Facing: HIGH - Directly exploitable via web interface with no authentication required.

🏢 Internal Only: HIGH - Even internally, this provides easy initial access for attackers who reach the device.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: CONFIRMED

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Simple HTTP POST request with PHP file upload. Multiple public exploits available.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Unknown specific version - check NUUO support

Vendor Advisory: Not publicly available

Restart Required: Yes

Instructions:

1. Contact NUUO support for latest firmware. 2. Backup configuration. 3. Upload firmware via web interface. 4. Reboot device.

🔧 Temporary Workarounds

Block upload.php access

linux

Use web application firewall or network firewall to block access to upload.php

iptables -A INPUT -p tcp --dport 80 -m string --string "upload.php" --algo bm -j DROP

Restrict file upload extensions

all

If device allows custom web server configuration, restrict uploadable file types

🧯 If You Can't Patch

Isolate NVRmini 2 on separate VLAN with strict firewall rules
Implement network segmentation to prevent lateral movement from compromised device

🔍 How to Verify

Check if Vulnerable:

Attempt to upload a test PHP file to http://[device-ip]/upload.php. If successful, device is vulnerable.

Check Version:

Check web interface login page or system info page for firmware version

Verify Fix Applied:

Attempt same upload test - should be rejected or return error.

📡 Detection & Monitoring

Log Indicators:

HTTP POST requests to upload.php with .php files
Unusual file creation in web directories

Network Indicators:

HTTP traffic to upload.php endpoint
Unexpected outbound connections from NVR device

SIEM Query:

source="web_logs" AND uri="/upload.php" AND method="POST" AND file_extension="php"

📊 Metadata

CVE ID: CVE-2018-11523

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-434

Published: May 29, 2018

Last Updated: November 21, 2024

🔗 References

https://github.com/unh3x/just4cve/issues/1 Third Party Advisory
https://www.exploit-db.com/exploits/44794/ Exploit,Third Party Advisory,VDB Entry
https://github.com/unh3x/just4cve/issues/1 Third Party Advisory
https://www.exploit-db.com/exploits/44794/ Exploit,Third Party Advisory,VDB Entry

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2018-11523, you might also want to check these: