CVE-2016-5677

This vulnerability is like a surveillance device having a “back door” that uses a password that never changes. Because the password is fixed and the device can be contacted over the network, a stranger can request a specific page and get sensitive information without needing to log in. Think of it as leaving a guest key permanently attached to the door—anyone who knows where to look can open it.

This matters if your business runs NUUO NVRmini 2, NUUO NVRsolo, or NETGEAR ReadyNAS Surveillance on the listed software versions. The findings indicate it can be reached over the network without authentication, and it’s reachable in the default configuration. Act urgently if your device is accessible from the internet (for example, via public exposure/port-forwarding/remote access); otherwise, risk is much lower if it’s only reachable inside your local network.

This is AMBER because attackers can remotely retrieve sensitive information without authentication, and the affected endpoint is reachable in default configurations. Public exploit code exists, and interest/attention is rising, which increases the chance of real-world attempts. There is no known fix version in the provided findings, so focus on shutting down external reachability immediately.

1. Confirm affected products and versions

   • Locate the device model and firmware/software version for each of:
     • NUUO NVRmini 2 (1.7.5 through 3.0.0)
     • NUUO NVRsolo (1.0.0 through 3.0.0)
     • NETGEAR ReadyNAS Surveillance (1.1.1 through 1.4.1)
   • If your version is outside these ranges, you may not be affected by this specific CVE.

2. Confirm reachability from outside your network

   • Check whether any firewall rules, NAT/port-forwarding, or “remote access” features expose the device to the internet.
   • Validate that the management/web interface is not publicly reachable (even if you use a VPN or another gateway, ensure you are not directly exposing the device).

3. Mitigate immediately (because no patch version is provided)

   • Restrict access so only your internal network can reach the device.
   • Remove/disable port forwards and any public DNS entries that point directly to the device.
   • If you must support remote viewing/admin, do it through a controlled method (for example, a properly secured VPN) rather than exposing the device endpoint directly.

4. Upgrade/replace with supported software

   • The provided findings state “no fix/patch information available,” so you’ll need to check the vendor’s currently supported firmware for your product and move to the latest supported version.
   • If the vendor does not provide an applicable fix, treat replacement as the likely long-term solution.

5. What to monitor

   • Device logs for unusual requests to the specific status endpoint behavior implied by the vulnerability.
   • Network logs/firewall logs for repeated inbound requests targeting the surveillance device.

KEV / CISA

• This CVE is not listed in CISA KEV based on the provided findings.

Target fix timeline

• Because a fixed version is not identified in the findings, prioritize exposure reduction today, then schedule firmware upgrade/replacement as soon as a supported option is available.

Severity is rated HIGH (CVSS 7.5). This is an information disclosure flaw (CWE-200) where a hidden account uses a fixed hardcoded password. The attack does not require authentication and does not require user interaction, and the vulnerability is reachable in default configuration. The attacker’s mechanism is to send a specific request to a known PHP endpoint (notably nvr_status_.php) to retrieve sensitive information. Exploitation maturity: public exploit code is available. KEV listing is not present per the provided findings, so follow the standard patch/exposure management process, but with stronger urgency due to known exploit availability and default reachability. Press attention is rising; EPSS is reported as a prediction (trend falling) and is not treated as proof of real-world exploitation in this response.