An unauthenticated arbitrary file read vulnerability in NUUO Network Video Recorder 2.0.0 poses a significant risk to data confidentiality.

The application is vulnerable to arbitrary file read because the up.php script fails to sanitize the url parameter before processing it with the fopen function. This flaw allows an unauthenticated attacker to remotely access files on the system.

The ability for an unauthenticated user to read arbitrary files from the server can lead to the exposure of sensitive configuration files, credentials, or system data. Given the CVSS score of 7.5, this high severity vulnerability could facilitate further exploitation, potentially leading to a complete compromise of the underlying monitoring infrastructure and subsequent unauthorized access to video feeds or network data.

Immediate Action: As no specific patch version is currently identified, restrict network access to the NUUO Network Video Recorder interface to trusted management networks only.

Proactive Monitoring: Monitor web server access logs for anomalous POST requests directed at the up.php endpoint, particularly those containing suspicious URL parameters or file paths.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block POST requests to up.php that attempt to pass file paths or non-standard URLs through the url parameter.

Public Exploit Available: Yes, a public proof-of-concept exists as referenced in the GitHub Gist linked in the vulnerability record.

This vulnerability represents a significant security oversight that exposes the NUUO Network Video Recorder to remote unauthorized data access. Security teams must prioritize isolating affected units from public-facing networks immediately. Until a vendor-supplied patch is made available, strict perimeter controls and monitoring are the only effective methods to mitigate the risk of exploitation.