{"id":"CVE-2016-5675","aliases":["EUVD-2016-6619","GHSA-h33j-gch2-5c9c"],"status":"published","title":"handle_daylightsaving.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0...","description":"handle_daylightsaving.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, NUUO Crystal 2.2.1 through 3.2.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the NTPServer parameter.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.70877,"percentile":0.99404,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-20"],"published":"2016-08-31T15:00:00Z","modified":"2026-11-01T02:30:17Z","exploits":[{"source":"exploitdb","id":"EDB-40200","title":"NUUO NVRmini2 / NVRsolo / Crystal Devices / NETGEAR ReadyNAS Surveillance Application - Multiple Vulnerabilities","type":"remote","platform":"hardware","date":"2016-08-05","url":"https://www.exploit-db.com/exploits/40200"},{"source":"metasploit","id":"exploit/linux/http/nuuo_nvrmini_auth_rce","title":"NUUO NVRmini 2 / Crystal / NETGEAR ReadyNAS Surveillance Authenticated Remote Code Execution","type":"exploit","platform":"Unix","date":"2016-08-04","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/nuuo_nvrmini_auth_rce"}],"products":[{"vendor":"netgear","product":"readynas_surveillance"},{"vendor":"nuuo","product":"crystal"},{"vendor":"nuuo","product":"nvrmini_2"},{"vendor":"nuuo","product":"nvrsolo"}],"references":[{"url":"http://www.kb.cert.org/vuls/id/856152","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","Third Party Advisory","US Government Resource","advisory"]},{"url":"http://www.securityfocus.com/bid/92318","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://www.exploit-db.com/exploits/40200/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5675"},{"url":"https://www.exploit-db.com/exploits/40200"},{"url":"https://github.com/advisories/GHSA-h33j-gch2-5c9c"}],"sources":{"cve":[{"id":"CVE-2016-5675","description":"handle_daylightsaving.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, NUUO Crystal 2.2.1 through 3.2.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the NTPServer parameter.","status":"published","published":"2016-08-31T15:00:00Z","modified":"2024-08-06T01:07:59.881Z","updated_at":"2026-11-02T14:33:30.359814Z"}],"euvd":[{"id":"EUVD-2016-6619","description":"handle_daylightsaving.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, NUUO Crystal 2.2.1 through 3.2.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the NTPServer parameter.","status":"published","published":"2016-08-31T15:00:00Z","modified":"2024-08-06T01:07:59Z","updated_at":"2026-11-03T02:22:42.006781Z"}],"ghsa":[{"id":"GHSA-h33j-gch2-5c9c","title":"handle_daylightsaving.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0...","description":"handle_daylightsaving.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, NUUO Crystal 2.2.1 through 3.2.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the NTPServer parameter.","status":"published","published":"2022-05-17T01:17:54Z","modified":"2025-04-12T13:04:41Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:01:29.190007Z"}],"nvd":[{"id":"CVE-2016-5675","description":"handle_daylightsaving.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, NUUO Crystal 2.2.1 through 3.2.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the NTPServer parameter.","status":"published","published":"2016-08-31T15:59:01.653Z","modified":"2026-06-17T00:49:51.273Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:28.854267Z"}],"osv":[{"id":"CVE-2016-5675","description":"handle_daylightsaving.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, NUUO Crystal 2.2.1 through 3.2.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the NTPServer parameter.","status":"published","published":"2016-08-31T15:59:01.653Z","modified":"2026-11-03T02:30:18.470327989Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T03:05:56.635441Z"}]}}