NUUO NVR CVE-2026-88622

Exploitation targets the handle_import_privilege.php endpoint of NUUO Network Video Recorder 2.0.0, which passes attacker-controlled input into an OS command without sanitization (CWE-77). Per the CVSS vector the attacker needs network access (AV:N) with no authentication (PR:N) and low complexity (AC:L), and SSVC rates it automatable=yes with total technical impact - so it is scriptable against exposed devices. The main limiting factors are: (1) the device/web interface must be network-reachable to the attacker (surveillance NVRs are often on internal networks, though many are internet-exposed); (2) the CVSS marks UI:R, indicating some user-interaction trigger may be involved that should be validated against the referenced PoC; and (3) only version 2.0.0 is confirmed affected, as the CPE and EUVD version fields are null placeholders.

This is a genuine high-priority issue, not a paper tiger. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) describes network-reachable, low-complexity, unauthenticated OS command injection with total confidentiality/integrity/availability impact, and CWE-77 confirms the class. The SSVC decision framework reinforces this: Exploitation=poc, Automatable=yes, Technical Impact=total - meaning exploit code exists, the attack can be scripted at scale, and success yields full device control. A public PoC gist is referenced (https://gist.github.com/4o3-f0rb1dd3n/...), so publicly available exploit code exists, though this is NOT the same as active exploitation. There is no CISA KEV listing and no EPSS score in the provided data, so widespread in-the-wild abuse is not confirmed - but for an internet-facing surveillance appliance with an automatable, unauthenticated RCE and public PoC, the practical risk of opportunistic mass exploitation is high. One tension to verify: CVSS marks UI:R (user interaction required) yet the endpoint is a directly-addressable PHP script and SSVC rates it automatable=yes; the UI:R flag may reflect a specific trigger flow (e.g. luring an operator to a crafted request) and should be confirmed against the PoC. The CPE string (cpe:2.3:a:n/a:n/a:*) is a null/garbage placeholder, so affected-version enumeration cannot be trusted beyond the stated 'NUUO NVR 2.0.0'.

An attacker locates an internet-exposed NUUO Network Video Recorder 2.0.0 and sends a crafted request to handle_import_privilege.php that injects shell metacharacters into an unsanitized parameter passed to a system call, executing arbitrary OS commands on the device. Public exploit code exists (a PoC gist is referenced) and SSVC rates the flaw automatable, so the attack can be weaponized into a scanner/worm; success gives full command execution (technical impact: total), enabling the NVR to be enrolled into a botnet or used to pivot into the surveillance network.