Critical
Security advisory
handle_daylightsaving.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, NUUO Crystal 2.2.1 through 3.2.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the NTPServer parameter.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2016-5675
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 05:27 UTC · Revision 1
Source evidence
handle_daylightsaving.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, NUUO Crystal 2.2.1 through 3.2.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the NTPServer parameter.
osv:CVE-2016-5675
Complete source record
{
"id": "f9714e3564918fa1a5f266106ad0dd70ae1039e41bb27a81c23c67b0a9b5b932",
"url": "https://osv.dev/vulnerability/CVE-2016-5675",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2016-5675",
"summary": "handle_daylightsaving.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, NUUO Crystal 2.2.1 through 3.2.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the NTPServer parameter.",
"evidence": "osv:CVE-2016-5675",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2016-5675",
"aliases": [
"CVE-2016-5675"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/crystal-lang/crystal",
"type": "GIT",
"events": [
{
"introduced": "6d9a1d5830db5f276bf3df37fceeb0d5333e7e14"
},
{
"last_affected": "b7377c0419ae5c1ce91e8298f075b3ff15636c54"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "1.1.1"
},
{
"last_affected": "1.4.1"
}
],
"source": "DESCRIPTION"
}
]
}
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-5675.json"
}
}
],
"modified": "2026-11-01T02:30:17.693096201Z",
"provider": "osv",
"references": [
"https://www.exploit-db.com/exploits/40200/"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:netgear:readynas_surveillance:1.1.1:*:*:*:*:*:*:*",
"cpe:2.3:a:netgear:readynas_surveillance:1.1.2:*:*:*:*:*:*:*",
"cpe:2.3:a:netgear:readynas_surveillance:1.2.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:netgear:readynas_surveillance:1.3.2.14:*:*:*:*:*:*:*",
"cpe:2.3:a:netgear:readynas_surveillance:1.3.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:netgear:readynas_surveillance:1.4.0:*:*:*:*:*:*:*",
"cpe:2.3:a:netgear:readynas_surveillance:1.4.1:*:*:*:*:*:*:*",
"cpe:2.3:a:netgear:readynas_surveillance:1.4.2:*:*:*:*:*:*:*"
],
"vendor_product": "netgear:readynas_surveillance",
"extracted_events": [
{
"range": [
{
"introduced": "1.1.1"
},
{
"last_affected": "1.1.1"
},
{
"introduced": "1.1.2"
},
{
"last_affected": "1.1.2"
},
{
"introduced": "1.2.0.4"
},
{
"last_affected": "1.2.0.4"
},
{
"introduced": "1.3.2.4"
},
{
"last_affected": "1.3.2.4"
},
{
"introduced": "1.3.2.14"
},
{
"last_affected": "1.3.2.14"
},
{
"introduced": "1.4.0"
},
{
"last_affected": "1.4.0"
},
{
"introduced": "1.4.1"
},
{
"last_affected": "1.4.1"
},
{
"introduced": "1.4.2"
},
{
"last_affected": "1.4.2"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:nuuo:crystal:2.2.1:*:*:*:*:*:*:*",
"cpe:2.3:a:nuuo:crystal:3.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:nuuo:crystal:3.1.0:*:*:*:*:*:*:*",
"cpe:2.3:a:nuuo:crystal:3.2.0:*:*:*:*:*:*:*"
],
"vendor_product": "nuuo:crystal",
"extracted_events": [
{
"range": [
{
"introduced": "2.2.1"
},
{
"last_affected": "2.2.1"
},
{
"introduced": "3.0.0"
},
{
"last_affected": "3.0.0"
},
{
"introduced": "3.1.0"
},
{
"last_affected": "3.1.0"
},
{
"introduced": "3.2.0"
},
{
"last_affected": "3.2.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:nuuo:nvrmini_2:1.7.5:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrmini_2:1.7.6:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrmini_2:2.0.0:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrmini_2:2.2.1:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrmini_2:3.0.0:*:*:*:*:*:*:*"
],
"vendor_product": "nuuo:nvrmini_2",
"extracted_events": [
{
"range": [
{
"introduced": "1.7.5"
},
{
"last_affected": "1.7.5"
},
{
"introduced": "1.7.6"
},
{
"last_affected": "1.7.6"
},
{
"introduced": "2.0.0"
},
{
"last_affected": "2.0.0"
},
{
"introduced": "2.2.1"
},
{
"last_affected": "2.2.1"
},
{
"introduced": "3.0.0"
},
{
"last_affected": "3.0.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:nuuo:nvrsolo:1.0.0:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrsolo:1.0.1:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrsolo:1.1.0.117:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrsolo:1.1.0:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrsolo:1.1.1:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrsolo:1.1.2:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrsolo:1.2.0:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrsolo:1.3.0:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrsolo:1.75:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrsolo:2.0.0:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrsolo:2.0.1:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrsolo:2.1.5:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrsolo:2.2.2:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrsolo:2.3.1.20:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrsolo:2.3.7.10:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrsolo:2.3.7.9:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrsolo:2.3.9.6:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrsolo:2.3:*:*:*:*:*:*:*",
"cpe:2.3:o:nuuo:nvrsolo:3.0.0:*:*:*:*:*:*:*"
],
"vendor_product": "nuuo:nvrsolo",
"extracted_events": [
{
"range": [
{
"introduced": "1.0.0"
},
{
"last_affected": "1.0.0"
},
{
"introduced": "1.0.1"
},
{
"last_affected": "1.0.1"
},
{
"introduced": "1.1.0"
},
{
"last_affected": "1.1.0"
},
{
"introduced": "1.1.0.117"
},
{
"last_affected": "1.1.0.117"
},
{
"introduced": "1.1.1"
},
{
"last_affected": "1.1.1"
},
{
"introduced": "1.1.2"
},
{
"last_affected": "1.1.2"
},
{
"introduced": "1.2.0"
},
{
"last_affected": "1.2.0"
},
{
"introduced": "1.3.0"
},
{
"last_affected": "1.3.0"
},
{
"introduced": "1.75"
},
{
"last_affected": "1.75"
},
{
"introduced": "2.0.0"
},
{
"last_affected": "2.0.0"
},
{
"introduced": "2.0.1"
},
{
"last_affected": "2.0.1"
},
{
"introduced": "2.1.5"
},
{
"last_affected": "2.1.5"
},
{
"introduced": "2.2.2"
},
{
"last_affected": "2.2.2"
},
{
"introduced": "2.3"
},
{
"last_affected": "2.3"
},
{
"introduced": "2.3.1.20"
},
{
"last_affected": "2.3.1.20"
},
{
"introduced": "2.3.7.9"
},
{
"last_affected": "2.3.7.9"
},
{
"introduced": "2.3.7.10"
},
{
"last_affected": "2.3.7.10"
},
{
"introduced": "2.3.9.6"
},
{
"last_affected": "2.3.9.6"
},
{
"introduced": "3.0.0"
},
{
"last_affected": "3.0.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"extracted_events": [
{
"range": [
{
"introduced": "1.7.5"
},
{
"last_affected": "3.0.0"
},
{
"introduced": "1.0.0"
},
{
"last_affected": "3.0.0"
},
{
"introduced": "2.2.1"
},
{
"last_affected": "3.2.0"
}
],
"source": "DESCRIPTION"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2016-5675",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 432209,
"published_at": "2016-08-31T15:59:01.653+00:00"
}