ACTIVELY EXPLOITED
CVE-2018-14933: NUUO NVRmini Devices OS Command Injection Vulnerability
| Vendor | NUUO |
|---|---|
| Product | NVRmini Devices |
| Actively exploited | Yes |
| Added to CISA KEV | 18 Dec 2024 |
| CISA federal deadline | 8 Jan 2025 |
| Weakness (CWE) | CWE-78 |
Required action (CISA's text)
The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
Description (NVD)
NUUO NVRmini devices contain an OS command injection vulnerability. This vulnerability allows remote command execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.
SOURCES
Other NUUO flaws
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.