NUUO NVRmini 2 NE-4160 ShellShock Remote Code Execution
Title: NUUO NVRmini 2 NE-4160 ShellShock Remote Code Execution
Advisory ID: ZSL-2016-5352
Type: Local/Remote
Impact: System Access
Risk: (4/5)
Release Date: 06.08.2016
NVR Version: 02.02.0000.0040
Device Pack Version: 04.07.0000.0030
lighttpd/1.4.28
PHP/5.5.3
[01.02.2016] Vendor contacted.
[02.02.2016] Vendor responds asking explanation.
[03.02.2016] Explained to vendor about the issues and risk.
[04.02.2016] Vendor ignores with confusion.
[10.02.2016] Sent another e-mail probe to several accounts for respond.
[16.02.2016] No response from the vendor.
[16.04.2016] Final try to get communication from the vendor and report issues.
[05.08.2016] No response from the vendor.
[06.08.2016] Public security advisory released.
[2] https://www.exploit-db.com/exploits/40213/
[3] https://packetstormsecurity.com/files/138224
[09.08.2016] - Added reference [1], [2] and [3]
Web: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk
Advisory ID: ZSL-2016-5352
Type: Local/Remote
Impact: System Access
Risk: (4/5)
Release Date: 06.08.2016
Summary
NUUO NVRmini 2 is the lightweight, portable NVR solution with NAS functionality. Setup is simple and easy, with automatic port forwarding settings built in. NVRmini 2 supports POS integration, making this the perfect solution for small retail chain stores. NVRmini 2 also comes full equipped as a NAS, so you can enjoy the full storage benefits like easy hard drive hot-swapping and RAID functions for data protection. Choose NVR and know that your valuable video data is safe, always.Description
NUUO NVRmini, NVRmini2, Crystal, NVRSolo suffers from authenticated ShellShock vulnerability. This could allow an attacker to gain control over a targeted computer if exploited successfully. The vulnerability affects Bash, a common component known as a shell that appears in many versions of Linux and Unix.Vendor
NUUO Inc. - http://www.nuuo.comAffected Version
Firmware Version: 02.02.00NVR Version: 02.02.0000.0040
Device Pack Version: 04.07.0000.0030
Tested On
GNU/Linux 2.6.31.8 (armv5tel)lighttpd/1.4.28
PHP/5.5.3
Vendor Status
[14.01.2016] Vulnerability discovered.[01.02.2016] Vendor contacted.
[02.02.2016] Vendor responds asking explanation.
[03.02.2016] Explained to vendor about the issues and risk.
[04.02.2016] Vendor ignores with confusion.
[10.02.2016] Sent another e-mail probe to several accounts for respond.
[16.02.2016] No response from the vendor.
[16.04.2016] Final try to get communication from the vendor and report issues.
[05.08.2016] No response from the vendor.
[06.08.2016] Public security advisory released.
PoC
nuuo_shellshock.txtCredits
Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>References
[1] https://cxsecurity.com/issue/WLB-2016080067[2] https://www.exploit-db.com/exploits/40213/
[3] https://packetstormsecurity.com/files/138224
Changelog
[06.08.2016] - Initial release[09.08.2016] - Added reference [1], [2] and [3]
Contact
Zero Science LabWeb: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk
