ZeroDay Findings
Sign inSign up

Findings

CVE-2022-23227

NUUO NVRmini2 Devices Missing Authentication Vulnerability

Published Jan 14, 2022 · updated Jun 16, 2026 · nuuo nvrmini2 firmware

NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root.

Timeline

Detection, updates, and resolution for this record.

  1. Jan 14, 2022 · Catalog

    Detected

    NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root.

  2. Dec 18, 2024 · CISA KEV

    Known exploited

    The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

  3. Jan 8, 2025 · CISA KEV

    Remediation due

    The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

  4. Jun 16, 2026 · Catalog

    Updated

    NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root.

Required action

The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

CISA due date Jan 8, 2025

Affected

  • cpe nuuo/nvrmini2 firmwareversion unspecified
  • vendor NUUO NVRmini2 Devicesversion unspecified

Sources

  • CISA KEVCVE-2022-23227

    NUUO NVRmini2 devices contain a missing authentication vulnerability that allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users.

    cisa.gov
  • CVE.orgCVE-2022-23227

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2022-23227

    30-day exploitation probability 48.5%

    first.org
  • NIST NVDCVE-2022-23227

    NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite

    nvd.nist.gov

References