CVE-2016-5675

EPSS 70.9%

Vexday Risk Score

60Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 70.9%KEV nãoPoC públicaNuclei —Metasploit simPatch —

Lifecycle

04 Aug 2016Metasploit module available

05 Aug 2016Public PoC

31 Aug 2016Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

handle_daylightsaving.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, NUUO Crystal 2.2.1 through 3.2.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the NTPServer parameter.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencewww.exploit-db.com/exploits/40200/unverified exploitdbwww.exploit-db.com/exploits/40200unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://www.exploit-db.com/exploits/40200/http://www.kb.cert.org/vuls/id/856152 http://www.securityfocus.com/bid/92318