CVE-2018-17894
📋 TL;DR
NUUO CMS versions 3.1 and earlier contain default accounts with hard-coded passwords that cannot be changed. This allows attackers to gain privileged access to the video management system. Organizations using NUUO CMS for security surveillance are affected.
💻 Affected Systems
- NUUO CMS (Central Management System)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to disable security cameras, manipulate video footage, access sensitive surveillance data, and pivot to other network systems.
Likely Case
Unauthorized access to live camera feeds, recorded footage, and system configuration leading to privacy violations and security system bypass.
If Mitigated
Limited impact if system is isolated in secure network segment with strict access controls and monitoring.
🎯 Exploit Status
Exploitation requires only knowledge of default credentials which are publicly documented. No special tools or skills needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 3.3 or later
Vendor Advisory: https://ics-cert.us-cert.gov/advisories/ICSA-18-284-02
Restart Required: Yes
Instructions:
1. Download NUUO CMS version 3.3 or later from vendor portal. 2. Backup current configuration. 3. Install updated version following vendor documentation. 4. Restart system. 5. Change all default passwords immediately after upgrade.
🔧 Temporary Workarounds
Change Default Credentials
allManually change all default account passwords in NUUO CMS administration interface
Network Segmentation
allIsolate NUUO CMS systems in separate VLAN with strict firewall rules
🧯 If You Can't Patch
- Immediately change all default passwords for every account in the system
- Implement network access controls to restrict access to NUUO CMS systems only from authorized management stations
🔍 How to Verify
Check if Vulnerable:
Check NUUO CMS version in administration interface. If version is 3.1 or earlier, system is vulnerable.Check Version:
Check version in NUUO CMS web interface under Help > About or System InformationVerify Fix Applied:
After patching, verify version is 3.3 or later and attempt to login with previously known default credentials - should fail.📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts followed by successful login with default usernames
- Login events from unexpected IP addresses
- Configuration changes from default accounts
Network Indicators:
- HTTP/HTTPS traffic to NUUO CMS web interface from unauthorized sources
- Unusual patterns of data export or system configuration changes
SIEM Query:
source="nuuo_cms" AND (event_type="login_success" AND (username="admin" OR username="nuuo"))