CVE-2022-23227: NUUO NVRmini2 Devices Missing Authentication Vulnerability
NUUO NVRmini2 devices contain a missing authentication vulnerability that allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users.
Other sources
NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handleimportuser.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
NUUO NVRmini2from your environment.Discontinue utilization of the product (end-of-life/end-of-service). Remove/uninstall NUUO NVRmini2 devices from your environment and take them out of service.
Event History
Frequently Asked Questions
What is the severity of CVE-2022-23227?
CVE-2022-23227 has a high severity rating due to its potential for unauthorized access to user management.
How do I fix CVE-2022-23227?
To fix CVE-2022-23227, update the NUUO NVRmini2 firmware to a version later than 3.11.
Who is affected by CVE-2022-23227?
CVE-2022-23227 affects NUUO NVRmini2 devices running firmware versions up to and including 3.11.
What types of attacks can exploit CVE-2022-23227?
CVE-2022-23227 can be exploited to allow unauthenticated attackers to upload files and create arbitrary user accounts.
Is authentication required to exploit CVE-2022-23227?
No, CVE-2022-23227 allows attackers to exploit the vulnerability without any authentication.