{"id":"CVE-2016-5675","details":"handle_daylightsaving.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, NUUO Crystal 2.2.1 through 3.2.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the NTPServer parameter.","modified":"2026-09-30T11:45:04.705081928Z","published":"2016-08-31T15:59:01.653Z","database_specific":{"unresolved_ranges":[{"vendor_product":"netgear:readynas_surveillance","cpes":["cpe:2.3:a:netgear:readynas_surveillance:1.1.1:*:*:*:*:*:*:*","cpe:2.3:a:netgear:readynas_surveillance:1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:netgear:readynas_surveillance:1.2.0.4:*:*:*:*:*:*:*","cpe:2.3:a:netgear:readynas_surveillance:1.3.2.14:*:*:*:*:*:*:*","cpe:2.3:a:netgear:readynas_surveillance:1.3.2.4:*:*:*:*:*:*:*","cpe:2.3:a:netgear:readynas_surveillance:1.4.0:*:*:*:*:*:*:*","cpe:2.3:a:netgear:readynas_surveillance:1.4.1:*:*:*:*:*:*:*","cpe:2.3:a:netgear:readynas_surveillance:1.4.2:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"1.1.1"},{"last_affected":"1.1.1"},{"introduced":"1.1.2"},{"last_affected":"1.1.2"},{"introduced":"1.2.0.4"},{"last_affected":"1.2.0.4"},{"introduced":"1.3.2.4"},{"last_affected":"1.3.2.4"},{"introduced":"1.3.2.14"},{"last_affected":"1.3.2.14"},{"introduced":"1.4.0"},{"last_affected":"1.4.0"},{"introduced":"1.4.1"},{"last_affected":"1.4.1"},{"introduced":"1.4.2"},{"last_affected":"1.4.2"}],"source":"CPE_STRING"},{"extracted_events":[{"introduced":"2.2.1"},{"last_affected":"2.2.1"},{"introduced":"3.0.0"},{"last_affected":"3.0.0"},{"introduced":"3.1.0"},{"last_affected":"3.1.0"},{"introduced":"3.2.0"},{"last_affected":"3.2.0"}],"source":"CPE_STRING","vendor_product":"nuuo:crystal","cpes":["cpe:2.3:a:nuuo:crystal:2.2.1:*:*:*:*:*:*:*","cpe:2.3:a:nuuo:crystal:3.0.0:*:*:*:*:*:*:*","cpe:2.3:a:nuuo:crystal:3.1.0:*:*:*:*:*:*:*","cpe:2.3:a:nuuo:crystal:3.2.0:*:*:*:*:*:*:*"]},{"cpes":["cpe:2.3:o:nuuo:nvrmini_2:1.7.5:*:*:*:*:*:*:*","cpe:2.3:o:nuuo:nvrmini_2:1.7.6:*:*:*:*:*:*:*","cpe:2.3:o:nuuo:nvrmini_2:2.0.0:*:*:*:*:*:*:*","cpe:2.3:o:nuuo:nvrmini_2:2.2.1:*:*:*:*:*:*:*","cpe:2.3:o:nuuo:nvrmini_2:3.0.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"1.7.5"},{"last_affected":"1.7.5"},{"introduced":"1.7.6"},{"last_affected":"1.7.6"},{"introduced":"2.0.0"},{"last_affected":"2.0.0"},{"introduced":"2.2.1"},{"last_affected":"2.2.1"},{"introduced":"3.0.0"},{"last_affected":"3.0.0"}],"source":"CPE_STRING","vendor_product":"nuuo:nvrmini_2"},{"vendor_product":"nuuo:nvrsolo","cpes":["cpe:2.3:o:nuuo:nvrsolo:1.0.0:*:*:*:*:*:*:*","cpe:2.3:o:nuuo:nvrsolo:1.0.1:*:*:*:*:*:*:*","cpe:2.3:o:nuuo:nvrsolo:1.1.0.117:*:*:*:*:*:*:*","cpe:2.3:o:nuuo:nvrsolo:1.1.0:*:*:*:*:*:*:*","cpe:2.3:o:nuuo:nvrsolo:1.1.1:*:*:*:*:*:*:*","cpe:2.3:o:nuuo:nvrsolo:1.1.2:*:*:*:*:*:*:*","cpe:2.3:o:nuuo:nvrsolo:1.2.0:*:*:*:*:*:*:*","cpe:2.3:o:nuuo:nvrsolo:1.3.0:*:*:*:*:*:*:*","cpe:2.3:o:nuuo:nvrsolo:1.75:*:*:*:*:*:*:*","cpe:2.3:o:nuuo:nvrsolo:2.0.0:*:*:*:*:*:*:*","cpe:2.3:o:nuuo:nvrsolo:2.0.1:*:*:*:*:*:*:*","cpe:2.3:o:nuuo:nvrsolo:2.1.5:*:*:*:*:*:*:*","cpe:2.3:o:nuuo:nvrsolo:2.2.2:*:*:*:*:*:*:*","cpe:2.3:o:nuuo:nvrsolo:2.3.1.20:*:*:*:*:*:*:*","cpe:2.3:o:nuuo:nvrsolo:2.3.7.10:*:*:*:*:*:*:*","cpe:2.3:o:nuuo:nvrsolo:2.3.7.9:*:*:*:*:*:*:*","cpe:2.3:o:nuuo:nvrsolo:2.3.9.6:*:*:*:*:*:*:*","cpe:2.3:o:nuuo:nvrsolo:2.3:*:*:*:*:*:*:*","cpe:2.3:o:nuuo:nvrsolo:3.0.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"1.0.0"},{"last_affected":"1.0.0"},{"introduced":"1.0.1"},{"last_affected":"1.0.1"},{"introduced":"1.1.0"},{"last_affected":"1.1.0"},{"introduced":"1.1.0.117"},{"last_affected":"1.1.0.117"},{"introduced":"1.1.1"},{"last_affected":"1.1.1"},{"introduced":"1.1.2"},{"last_affected":"1.1.2"},{"introduced":"1.2.0"},{"last_affected":"1.2.0"},{"introduced":"1.3.0"},{"last_affected":"1.3.0"},{"introduced":"1.75"},{"last_affected":"1.75"},{"introduced":"2.0.0"},{"last_affected":"2.0.0"},{"introduced":"2.0.1"},{"last_affected":"2.0.1"},{"introduced":"2.1.5"},{"last_affected":"2.1.5"},{"introduced":"2.2.2"},{"last_affected":"2.2.2"},{"introduced":"2.3"},{"last_affected":"2.3"},{"introduced":"2.3.1.20"},{"last_affected":"2.3.1.20"},{"introduced":"2.3.7.9"},{"last_affected":"2.3.7.9"},{"introduced":"2.3.7.10"},{"last_affected":"2.3.7.10"},{"introduced":"2.3.9.6"},{"last_affected":"2.3.9.6"},{"introduced":"3.0.0"},{"last_affected":"3.0.0"}],"source":"CPE_STRING"},{"extracted_events":[{"introduced":"1.7.5"},{"fixed":"3.0.0"},{"introduced":"1.0.0"},{"fixed":"3.0.0"},{"introduced":"2.2.1"},{"fixed":"3.2.0"}],"source":"DESCRIPTION"}]},"references":[{"type":"WEB","url":"http://www.securityfocus.com/bid/92318"},{"type":"WEB","url":"https://www.exploit-db.com/exploits/40200/"},{"type":"ADVISORY","url":"http://www.kb.cert.org/vuls/id/856152"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/crystal-lang/crystal","events":[{"introduced":"6d9a1d5830db5f276bf3df37fceeb0d5333e7e14"},{"fixed":"b7377c0419ae5c1ce91e8298f075b3ff15636c54"}],"database_specific":{"source":"DESCRIPTION","extracted_events":[{"introduced":"1.1.1"},{"fixed":"1.4.1"}]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-5675.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}