handle_daylightsaving.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, NUUO Crystal 2.2.1 through 3.2.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the NTPServer parameter.
{
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:netgear:readynas_surveillance:1.1.1:*:*:*:*:*:*:*",
"cpe:2.3:a:netgear:readynas_surveillance:1.1.2:*:*:*:*:*:*:*",
"cpe:2.3:a:netgear:readynas_surveillance:1.2.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:netgear:readynas_surveillance:1.3.2.14:*:*:*:*:*:*:*",
"cpe:2.3:a:netgear:readynas_surveillance:1.3.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:netgear:readynas_surveillance:1.4.0:*:*:*:*:*:*:*",
"cpe:2.3:a:netgear:readynas_surveillance:1.4.1:*:*:*:*:*:*:*",
"cpe:2.3:a:netgear:readynas_surveillance:1.4.2:*:*:*:*:*:*:*"
],
"extracted_events": [
{
"introduced": "1.1.1"
},
{
"last_affected": "1.1.1"
},
{
"introduced": "1.1.2"
},
{
"last_affected": "1.1.2"
},
{
"introduced": "1.2.0.4"
},
{
"last_affected": "1.2.0.4"
},
{
"introduced": "1.3.2.4"
},
{
"last_affected": "1.3.2.4"
},
{
"introduced": "1.3.2.14"
},
{
"last_affected": "1.3.2.14"
},
{
"introduced": "1.4.0"
},
{
"last_affected": "1.4.0"
},
{
"introduced": "1.4.1"
},
{
"last_affected": "1.4.1"
},
{
"introduced": "1.4.2"
},
{
"last_affected": "1.4.2"
}
],
"source": "CPE_STRING",
"vendor_product": "netgear:readynas_surveillance"
},
{
"cpes": [
"cpe:2.3:a:nuuo:crystal:2.2.1:*:*:*:*:*:*:*",
"cpe:2.3:a:nuuo:crystal:3.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:nuuo:crystal:3.1.0:*:*:*:*:*:*:*",
"cpe:2.3:a:nuuo:crystal:3.2.0:*:*:*:*:*:*:*"
],
"extracted_events": [
{
"introduced": "2.2.1"
},
{
"last_affected": "2.2.1"
},
{
"introduced": "3.0.0"
},
{
"last_affected": "3.0.0"
},
{
"introduced": "3.1.0"
},
{
"last_affected": "3.1.0"
},
{
"introduced": "3.2.0"
},
{
"last_affected": "3.2.0"
}
],
"source": "CPE_STRING",
"vendor_product": "nuuo:crystal"
},
{
"cpes": [
"cpe:2.3:o:nuuo:nvrmini_2:1.7.5:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrmini_2:1.7.6:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrmini_2:2.0.0:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrmini_2:2.2.1:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrmini_2:3.0.0:*:*:*:*:*:*:*"
],
"extracted_events": [
{
"introduced": "1.7.5"
},
{
"last_affected": "1.7.5"
},
{
"introduced": "1.7.6"
},
{
"last_affected": "1.7.6"
},
{
"introduced": "2.0.0"
},
{
"last_affected": "2.0.0"
},
{
"introduced": "2.2.1"
},
{
"last_affected": "2.2.1"
},
{
"introduced": "3.0.0"
},
{
"last_affected": "3.0.0"
}
],
"source": "CPE_STRING",
"vendor_product": "nuuo:nvrmini_2"
},
{
"cpes": [
"cpe:2.3:o:nuuo:nvrsolo:1.0.0:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrsolo:1.0.1:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrsolo:1.1.0.117:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrsolo:1.1.0:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrsolo:1.1.1:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrsolo:1.1.2:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrsolo:1.2.0:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrsolo:1.3.0:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrsolo:1.75:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrsolo:2.0.0:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrsolo:2.0.1:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrsolo:2.1.5:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrsolo:2.2.2:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrsolo:2.3.1.20:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrsolo:2.3.7.10:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrsolo:2.3.7.9:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrsolo:2.3.9.6:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrsolo:2.3:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrsolo:3.0.0:*:*:*:*:*:*:*"
],
"extracted_events": [
{
"introduced": "1.0.0"
},
{
"last_affected": "1.0.0"
},
{
"introduced": "1.0.1"
},
{
"last_affected": "1.0.1"
},
{
"introduced": "1.1.0"
},
{
"last_affected": "1.1.0"
},
{
"introduced": "1.1.0.117"
},
{
"last_affected": "1.1.0.117"
},
{
"introduced": "1.1.1"
},
{
"last_affected": "1.1.1"
},
{
"introduced": "1.1.2"
},
{
"last_affected": "1.1.2"
},
{
"introduced": "1.2.0"
},
{
"last_affected": "1.2.0"
},
{
"introduced": "1.3.0"
},
{
"last_affected": "1.3.0"
},
{
"introduced": "1.75"
},
{
"last_affected": "1.75"
},
{
"introduced": "2.0.0"
},
{
"last_affected": "2.0.0"
},
{
"introduced": "2.0.1"
},
{
"last_affected": "2.0.1"
},
{
"introduced": "2.1.5"
},
{
"last_affected": "2.1.5"
},
{
"introduced": "2.2.2"
},
{
"last_affected": "2.2.2"
},
{
"introduced": "2.3"
},
{
"last_affected": "2.3"
},
{
"introduced": "2.3.1.20"
},
{
"last_affected": "2.3.1.20"
},
{
"introduced": "2.3.7.9"
},
{
"last_affected": "2.3.7.9"
},
{
"introduced": "2.3.7.10"
},
{
"last_affected": "2.3.7.10"
},
{
"introduced": "2.3.9.6"
},
{
"last_affected": "2.3.9.6"
},
{
"introduced": "3.0.0"
},
{
"last_affected": "3.0.0"
}
],
"source": "CPE_STRING",
"vendor_product": "nuuo:nvrsolo"
},
{
"extracted_events": [
{
"introduced": "1.7.5"
},
{
"fixed": "3.0.0"
},
{
"introduced": "1.0.0"
},
{
"fixed": "3.0.0"
},
{
"introduced": "2.2.1"
},
{
"fixed": "3.2.0"
}
],
"source": "DESCRIPTION"
}
]
}