rootpwn

high · CVSS v3 8.8

CVE-2026-88622

NUUO Network Video Recorder 2.0.0 is vulnerable to command injection via handle_import_privilege.php, allowing attackers to execute arbitrar

Overview

NUUO Network Video Recorder 2.0.0 is vulnerable to command injection via handle_import_privilege.php, allowing attackers to execute arbitrary commands on the device. This flaw could lead to full compromise of the recorder and any connected network. The vulnerability is exploitable remotely without authentication.

Description

NUUO Network Video Recorder 2.0.0 is vulnerable to Command Injection in handle_import_privilege.php.

Impact

The vulnerability threatens confidentiality, integrity, and availability of the NVR system. Attackers could gain unauthorized access, modify or delete recordings, and disrupt surveillance services. Network administrators and security teams are directly impacted.

Remediation

Apply the vendor’s firmware patch that removes or secures handle_import_privilege.php. If a patch is unavailable, disable the import privilege endpoint or restrict it to trusted IPs. Enforce least privilege on the web interface and segment the NVR from the rest of the network.

Risk context

Severity is high with a CVSS v3 score of 8.8. The flaw is critical for devices running the affected firmware and requires prompt attention.

Affected products

  • NUUO NVR 2.0.0
  • NUUO Network Video Recorder 2.0.0

Scores

Severity
high
CVSS v2
7.5
CVSS v3
8.8
CVSS v4
—
EPSS
—

command-injection network-video-recorder NUUO high-severity firmware remote-execution

← All CVEs

Related CVEs

high

CVE-2026-93455

django-page-cms through version 2.0.13 contains an authorization bypass vulnerability in its admin helper views. The flaw allows low-privilege staff accounts to read unpublished drafts, page listings, and stored media paths without proper permission validation. This matters because it exposes sensitive organizational content to internal users who should not have access.

View analysis

high

CVE-2026-52727

The lxc-ci project inadvertently included a static pacman local-signing private key within Arch Linux container and virtual machine images built prior to May 28, 2026. This allows a malicious or compromised package mirror to issue cryptographically trusted packages to clients. Consequently, attackers can achieve arbitrary code execution as root on affected systems.

View analysis

high

CVE-2026-88259

CareCam CM2507 IP cameras expose their network video streaming service without requiring authentication. An attacker with network access can view live video streams. This allows unauthorized surveillance and potential privacy violations.

View analysis

high

CVE-2026-88623

NUUO Network Video Recorder 2.0.0 allows unauthenticated users to read arbitrary files via the up.php endpoint. By submitting a crafted URL in a POST request, attackers can download any file accessible to the web server. This flaw exposes sensitive data and system configuration.

View analysis