← CVE Radar
CVE-2022-23227NUUO NVRmini2 Devices Missing Authentication Vulnerability
NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root.
9.8 CRITICALEPSS 48.49%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.8 | CRITICAL | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 10.0 | HIGH | 2.0NVD | AV:N/AC:L/Au:N/C:C/I:C/A:C |
CISA required action
⚡ Known exploited · remediation due Jan 8, 2025
The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
Details
- CVE ID
- CVE-2022-23227
- Status
- Analyzed
- Assigner (CNA)
- mitre
- Published
- Jan 14, 2022
- Last modified
- 2026-06-17 04:29 UTC
- Weaknesses
Affected Products
From NVD CPE configurations.
nuuonvrmini2 firmware1 version range
- through 3.11.0
References
- github.com https://github.com/pedrib/PoC/blob/master/advisories/NUUO/nuuo_nvrmini_round2.mkd
- github.com https://github.com/rapid7/metasploit-framework/pull/16044
- news.ycombinator.com https://news.ycombinator.com/item?id=29936569
- portswigger.net https://portswigger.net/daily-swig/researcher-discloses-alleged-zero-day-vulnerabilities-in-nuuo-nvrmini2-recording-device
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-23227