CVE-2016-5676

Name of the Vulnerable Software and Affected Versions NUUO NVRmini 2 versions 1.7.5 through 2.x NUUO NVRsolo versions 1.7.5 through 2.x NETGEAR ReadyNAS Surveillance versions 1.1.1 through 1.4.1

Description The issue allows remote attackers to reset the administrator password via a cmd=loaddefconfig action in the cgi-bin/cgi system endpoint.

Recommendations For NUUO NVRmini 2 versions 1.7.5 through 2.x, consider restricting access to the cgi-bin/cgi system endpoint until a fix is available. For NUUO NVRsolo versions 1.7.5 through 2.x, avoid using the cmd=loaddefconfig action in the cgi-bin/cgi system endpoint until the issue is resolved. For NETGEAR ReadyNAS Surveillance versions 1.1.1 through 1.4.1, restrict access to the cgi-bin/cgi system endpoint to minimize the risk of exploitation.