The vulnerability is an unauthenticated arbitrary file read flaw located in the up.php page of NUUO Network Video Recorder version 2.0.0. The application accepts a "url" parameter in a POST request, then uses fopen to open that URL and writes the content into /tmp with a filename derived from the URL's basename. Because no authentication or input validation is performed, an attacker can supply any file path or remote URL that PHP is able to open, enabling read access to local files such as configuration files, credentials, or logs. This directly violates the confidentiality of the system and allows disclosure of sensitive data.

The affected product is NUUO Network Video Recorder 2.0.0. No vendor or product vendor strings are listed, and the vulnerable code is part of the proprietary firmware or web interface shipped by NUUO. The flaw has been demonstrated in the released 2.0.0 build, and any installations that have not applied a post‑release patch are susceptible.

Because the flaw requires no authentication and has no input similarity checks, it is trivially exploitable when allow_url_fopen is enabled. No public CVSS score is available, but the lack of authentication and the ability to read arbitrary files indicate a high impact condition. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, so there are no known active exploit campaigns reported at the time of this analysis. However, the business impact of exposing configuration or credential files warrants urgent remediation.