CVE-2022-23227
CriticalActively exploited (CISA KEV)
Description
NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root.
SeverityCritical
CVSS9.8
Exploit probability—
ProductNUUO NVRmini2 Devices
PublishedJan 14, 2022
First seenJan 14, 2022
Added to KEVDec 18, 2024
Weakness typeCWE-306Missing authentication for critical function
How to fix
CISA required action
The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
CISA due date: Jan 8, 2025Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nuuo nvrmini2_firmware | v ≤ 3.11.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.