Is CVE-2018-14933 actively exploited?

Yes. CVE-2018-14933 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2018-14933 be exploited remotely?

The attack vector of CVE-2018-14933 has not been classified yet.

What is the CVSS score of CVE-2018-14933?

CVE-2018-14933 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2018-14933

HIGHCISA KEVIN THE WILD

CVE-2018-14933

Published: December 18, 2024

EPSS:93.87%probability of exploitation in 30 daysPercentile:99.9th

Official Description

NUUO NVRmini devices contain an OS command injection vulnerability. This vulnerability allows remote command execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.

NVD Source

CISA KEV Advisory

NUUO NVRmini Devices OS Command Injection Vulnerability

Added to KEV: 2024-12-18Federal patch deadline: 2025-01-08

Required Action (CISA)

The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

Risk Analysis

NUUO NVRmini devices are affected by an OS command injection vulnerability that permits remote command execution through shell metacharacters in the uploaddir parameter. With an EPSS score of 0.93874, the likelihood of exploitation is very high, and its inclusion in CISA's KEV confirms active exploitation, making this a critical vulnerability.

This vulnerability is actively being exploited in the wild, as confirmed by its 'in_the_wild' exploit status and inclusion in CISA's KEV. It is remotely exploitable through specific parameters.

Recommended Action

Users of NUUO NVRmini devices should apply all available security patches and firmware updates immediately. Restricting network access to these devices and implementing input validation on user-supplied data are also crucial.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2018-14933 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2018-14933 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.