NUUO NVR Default Credentials Unauthenticated Remote Access (CVE-2022-25521)

Vulnerability Overview Vulnerability Name: Unauthorized Remote Access to NUUO Network Video Recorder Internal Panel Using Default Credentials Discoverer: Dnyanesh A. Gawande Publication Date: March 24, 2022 Affected Versions: ≤ 1.0 Vendor Homepage: https://nuuo.com/ CVE ID: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25521 Scope of Impact Vulnerability Description: A vulnerability in the NUUO Web Network Video Recorder interface allows unauthenticated remote users to access sensitive parts of the system with high-privilege accounts. Root Cause: A default account exists with the username "admin" and password "admin". Attackers can exploit this default account to connect to the affected system, gaining read and write access to system data, including the ability to configure the affected device. This grants attackers access to sensitive system components and full administrative privileges to control the device, thereby increasing the severity of the vulnerability. Attack Vector: Malicious attackers can exploit this vulnerability by remotely logging into the affected system using the default credentials. Remediation Steps: 1. Access the NUUO administration panel. 2. Enter the username "admin" and password "admin" and click Login. 3. After redirecting to the Video Recorder's administration panel, you can read and control the device and remotely change its configuration. Proof of Concept (POC) Screenshots: - Login Interface: !Login Interface - Administration Panel: !Administration Panel Search Engines Shodan: Nuuo Tags Admin Adminpanel Bugbounty Poc Bug Bounty Bug Bounty Tips Author Information Author: Dnyanesh Gawande Followers: 1 Following: 1 Additional Information Subscription: Get Dnyanesh Gawande's stories in your inbox Subscription Form: - Enter your email - Subscribe - Remember me for faster login Footer Help: Status, About, Hiring, News, Blog, Store, Privacy, Rules, Terms, Text-to-Speech --- Summary This vulnerability involves the remote access of NUUO Network Video Recorders using default credentials (username "admin", password "admin"), leading to unauthorized access and potential system control. The remediation method is to change the default credentials or disable the default account.

Goal Reached Thanks to every supporter — we hit 100%!

NUUO NVR Default Credentials Unauthenticated Remote Access (CVE-2022-25521)