Remote Code Execution in NUUO NVRMini2 cgi_system

Successful exploitation allows remote attackers to execute arbitrary code with the privileges of the web server process, leading to full device compromise. In the context of the Rabbot malware campaign, this vulnerability was used to gain initial access to NVRMini2 devices, enabling the installation of cryptocurrency miners and further propagation of the worm to other IoT and Linux devices. Attackers can leverage this to pivot within networks, deploy additional malware, or disrupt surveillance infrastructure.

Restrict network access to the NVRMini2 device, especially the HTTP interface, to trusted hosts only. Employ network segmentation to isolate IoT devices from critical infrastructure. Monitor for indicators of compromise, such as unexpected processes or connections, and apply virtual patching or web application firewall rules to block malicious HTTP requests targeting the cgi_system endpoint.

Upgrade NUUO NVRMini2 devices to a firmware version that addresses CVE-2018-1149. If a patch is not available, disable or restrict access to the cgi_system endpoint via network segmentation or firewall rules. Monitor for abnormal HTTP requests targeting the device and review device logs for signs of exploitation.