The vulnerability is an unauthenticated arbitrary file read flaw located in the up.php page of NUUO Network Video Recorder version 2.0.0. The application accepts a "url" parameter in a POST request, then uses fopen to open that URL and writes the content into /tmp with a filename derived from the URL's basename. Because no authentication or input validation is performed, an attacker can supply any file path or remote URL that PHP is able to open, enabling read access to local files such as configuration files, credentials, or logs. This directly violates the confidentiality of the system and allows disclosure of sensitive data.

The affected product is NUUO Network Video Recorder 2.0.0. No vendor or product vendor strings are listed, and the vulnerable code is part of the proprietary firmware or web interface shipped by NUUO. The flaw has been demonstrated in the released 2.0.0 build, and any installations that have not applied a post‑release patch are susceptible.

The CVSS score of 7.5 indicates high severity, while the EPSS score of <1% shows a low likelihood of exploitation at this time, and it is not listed in CISA KEV. Because the flaw requires no authentication and has no input similarity checks, the vulnerability is trivially exploitable when allow_url_fopen is enabled. Based on the description, it is inferred that this condition must be present for exploitation. The lack of authentication and the ability to read arbitrary files indicate a high impact condition, and the business impact of exposing configuration or credential files warrants urgent remediation.