CVE-2016-5677

Name of the Vulnerable Software and Affected Versions NUUO NVRmini 2 versions 1.7.5 through 3.0.0 NUUO NVRsolo versions 1.0.0 through 3.0.0 NETGEAR ReadyNAS Surveillance versions 1.1.1 through 1.4.1

Description The issue allows remote attackers to obtain sensitive information due to a hardcoded password for the nuuoeng account. This can be exploited via an nvr status .php request.

Recommendations For NUUO NVRmini 2 versions 1.7.5 through 3.0.0, consider changing the hardcoded password for the nuuoeng account. For NUUO NVRsolo versions 1.0.0 through 3.0.0, consider changing the hardcoded password for the nuuoeng account. For NETGEAR ReadyNAS Surveillance versions 1.1.1 through 1.4.1, consider changing the hardcoded password for the nuuoeng account. As a temporary workaround, consider restricting access to the nvr status .php endpoint until a patch is available.