Zero Radar
← feed
CriticalVulnerabilityupdated 29 Oct 2026, 04:30 UTC

NUUO Crystal Server: unauthenticated file upload allows remote code execution

Someone on the internet with no password could upload a file to the NUUO video management server and make it run commands on the machine. That could let them take control of the server and the camera system it manages.

1 source, unconfirmed
SeverityCriticalVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?1 source, unconfirmedOnly one publisher so far, details may change

How the attack works simplified

  1. 1Remote attackerNo login or password required
  2. 2Crystal upload.phpAccepts unauthenticated file upload
  3. 3PHP web root writeUploaded file saved where the server runs it
  4. 4lighttpd fastcgi runs PHPPasses .php requests to php-cgi
  5. 5Code runs as service accountAttacker gets command execution on server
  6. ResultAttacker controls the NUUO server

What happened

NUUO Crystal Server 3.19.0.85 has an unauthenticated upload.php endpoint that writes attacker-supplied files into the PHP web root, and lighttpd's fastcgi mapping executes .php files via /usr/bin/php-cgi, giving server-side code execution as the web service account.

Why it is dangerous: An attacker needs no login and can run code on the server, which sits in the management plane of video surveillance deployments; anyone exposing it to a network is at risk.

Are you affected?

You are affected if you run NUUO Crystal Server version 3.19.0.85 (including the Crystal OVA virtual appliance), especially if it is reachable from networks you do not fully trust.

NUUO Crystal Server 3.19.0.85 (Crystal virtual-machine appliance, Ubuntu-based OVA with lighttpd and PHP).

What to do

  1. Check whether any NUUO Crystal Server is running version 3.19.0.85.
  2. Restrict network access to the Crystal web interface so it is not reachable from the internet or untrusted networks.
  3. Check the NUUO vendor site for a patched release and apply it as soon as it is available.
  4. Review the web root and server for unexpected uploaded PHP files and investigate any found.

Timeline

  1. 29 Oct 2026, 04:12 UTC
    Publicly disclosed
  2. 29 Oct 2026, 04:12 UTC
    Reported by Full Disclosure · Full Disclosure
  3. 29 Oct 2026, 04:30 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Security researchers research teams and mailing lists

Technical details

ID
ZR-3d4980ac
Disclosed
29 Oct 2026, 04:12 UTC
On Zero Radar
29 Oct 2026, 04:30 UTC (18 min after disclosure)
Last change
29 Oct 2026, 04:30 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

NUUO Crystal Server: unauthenticated file upload allows remote code execution · Zero Radar