Lucene search

[email protected]CVE-2016-5677

HistoryAug 31, 2016 - 3:59 p.m.

CVE-2016-5677

2016-08-3115:59:03

CWE-200

[email protected]

web.nvd.nist.gov

cve-2016-5677

nuuo

nvrmini

nvrsolo

netgear

readynas

hardcoded password

vulnerability

remote attack

sensitive information

security issue

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.7 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

68.7%

JSON

NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 have a hardcoded qwe23622260 password for the nuuoeng account, which allows remote attackers to obtain sensitive information via an nvr_status_.php request.

Affected configurations

NVD

Node

netgearreadynas_surveillanceMatch1.1.1

netgearreadynas_surveillanceMatch1.1.2

netgearreadynas_surveillanceMatch1.2.0.4

netgearreadynas_surveillanceMatch1.3.2.4

netgearreadynas_surveillanceMatch1.3.2.14

netgearreadynas_surveillanceMatch1.4.0

netgearreadynas_surveillanceMatch1.4.1

netgearreadynas_surveillanceMatch1.4.2

Node

nuuonvrmini_2Match1.7.5

nuuonvrmini_2Match1.7.6

nuuonvrmini_2Match2.0.0

nuuonvrmini_2Match2.2.1

nuuonvrmini_2Match3.0.0

Node

nuuonvrsoloMatch1.0.0

nuuonvrsoloMatch1.0.1

nuuonvrsoloMatch1.1.0

nuuonvrsoloMatch1.1.0.117

nuuonvrsoloMatch1.1.1

nuuonvrsoloMatch1.1.2

nuuonvrsoloMatch1.2.0

nuuonvrsoloMatch1.3.0

nuuonvrsoloMatch1.75

nuuonvrsoloMatch2.0.0

nuuonvrsoloMatch2.0.1

nuuonvrsoloMatch2.1.5

nuuonvrsoloMatch2.2.2

nuuonvrsoloMatch2.3

nuuonvrsoloMatch2.3.1.20

nuuonvrsoloMatch2.3.7.9

nuuonvrsoloMatch2.3.7.10

nuuonvrsoloMatch2.3.9.6

nuuonvrsoloMatch3.0.0

CPENameOperatorVersion
netgear:readynas_surveillancenetgear readynas surveillanceeq1.1.1
netgear:readynas_surveillancenetgear readynas surveillanceeq1.1.2
netgear:readynas_surveillancenetgear readynas surveillanceeq1.2.0.4
netgear:readynas_surveillancenetgear readynas surveillanceeq1.3.2.4
netgear:readynas_surveillancenetgear readynas surveillanceeq1.3.2.14
netgear:readynas_surveillancenetgear readynas surveillanceeq1.4.0
netgear:readynas_surveillancenetgear readynas surveillanceeq1.4.1
netgear:readynas_surveillancenetgear readynas surveillanceeq1.4.2

CPE	Name	Operator	Version
netgear:readynas_surveillance	netgear readynas surveillance	eq	1.1.1
netgear:readynas_surveillance	netgear readynas surveillance	eq	1.1.2
netgear:readynas_surveillance	netgear readynas surveillance	eq	1.2.0.4
netgear:readynas_surveillance	netgear readynas surveillance	eq	1.3.2.4
netgear:readynas_surveillance	netgear readynas surveillance	eq	1.3.2.14
netgear:readynas_surveillance	netgear readynas surveillance	eq	1.4.0
netgear:readynas_surveillance	netgear readynas surveillance	eq	1.4.1
netgear:readynas_surveillance	netgear readynas surveillance	eq	1.4.2