CVE-2019-9653

Think of your video recorder like a locked building with a front desk. This bug can act like someone finds a trick in the desk’s “configuration” process that lets them give the building staff any order they want—without needing a password.

If the recorder is reachable, an attacker could potentially take over the device, disrupt it, or interfere with how it handles footage.

This matters if you operate NUUO Network Video Recorder and its firmware is in the 1.7.x through 3.3.x range.

Because the issue is unauthenticated, the risk is mainly about reachability: it’s most concerning if attackers can reach the recorder over the network (especially from the internet) and trigger the vulnerable configuration handler.

This is urgent enough to act on now because attackers don’t need a login to trigger the command execution path, and public proof-of-concept code exists.

However, it’s not confirmed in CISA KEV, so it’s not the highest “act instantly” tier—still, you should upgrade promptly and limit network exposure immediately.

1. Confirm exposure (owners/IT checklist)

   • Identify every NUUO Network Video Recorder in your environment.
   • For each device, record the firmware version.
   • Determine whether it is within 1.7.x through 3.3.x. If yes, treat the device as affected.

2. Validate whether it’s reachable

   • Check how the recorder is exposed: is it directly reachable from the public internet, or only via an internal network/VPN?
   • If you use port-forwarding or have public-facing access, assume the risk is higher.

3. Upgrade to the fixed firmware

   • Go to NUUO’s remediation/download page: https://www.nuuo.com/DownloadMainpage.php
   • Locate the firmware release that remediates CVE-2019-9653 for your current device model/branch.
   • Upgrade all affected recorders.
   • Keep notes of the before/after firmware versions.

4. Temporary containment if you can’t patch immediately

   • Remove/disable public internet reachability (stop port-forwarding) and keep access to internal networks or approved VPN only.
   • If you have a reverse proxy or firewall in front, tighten rules so only your management endpoints can reach the recorder.

5. Post-upgrade checks

   • Confirm the recorder is operating normally after the firmware update.
   • Review device/system logs for unusual activity targeting handle_load_config.php (look for repeated requests, odd parameters, or spikes in configuration-related traffic).

6. What to monitor after remediation

   • Ongoing log entries showing repeated failed requests or configuration handler hits.
   • Any unexpected service restarts or abnormal device behavior following network-access attempts.

CVE-2019-9653 affects NUUO Network Video Recorder Firmware 1.7.x through 3.3.x. The weakness is command injection (CWE-78) in handle_load_config.php: the application can be coerced into executing arbitrary OS commands using shell metacharacters provided by an attacker.

Attackers do not need authentication, so the practical risk depends heavily on whether the vulnerable endpoint is reachable over the network. CISA KEV does not list this issue (not yet confirmed there). There is public weaponization in the form of a proof-of-concept (1 known). Press attention is reported as rising.

EPSS is available as a prediction, and the trend is falling, but public urgency here is driven more by the presence of a usable proof-of-concept and the unauthenticated command execution mechanism than by prediction alone.