NUUO · NVRmini2 Devices
CVE-2022-23227
NUUO NVRmini2 Devices Missing Authentication Vulnerability
What it is
NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root.
CISA: NUUO NVRmini2 devices contain a missing authentication vulnerability that allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users.
What to do
The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
Deadline for US federal agencies: January 8, 2025
- Added to the CISA list
- December 18, 2024
- Published
- January 14, 2022
- Severity
- Critical 9.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 48% in the top 1.1% of all known vulnerabilities
- Weakness
- CWE-306
- More details
- NVD · CVE.org · CISA
All references (4)
More exploited flaws from NUUO
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Dec 18, 2024 | OS Command Injection Vulnerability | NVRmini Devices | Critical 9.8 | 95% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.