CVE-2022-23227: NUUO NVRmini2 Devices Missing Authentication Vulnerability
NUUO NVRmini2 devices contain a missing authentication vulnerability that allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users.
Other sources
NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handleimportuser.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Discontinue utilization of NUUO NVRmini2 devices.
Event History
Frequently Asked Questions
What is the severity of CVE-2022-23227?
CVE-2022-23227 has a high severity rating due to its potential for unauthorized access to user management.
How do I fix CVE-2022-23227?
To fix CVE-2022-23227, update the NUUO NVRmini2 firmware to a version later than 3.11.
Who is affected by CVE-2022-23227?
CVE-2022-23227 affects NUUO NVRmini2 devices running firmware versions up to and including 3.11.
What types of attacks can exploit CVE-2022-23227?
CVE-2022-23227 can be exploited to allow unauthenticated attackers to upload files and create arbitrary user accounts.
Is authentication required to exploit CVE-2022-23227?
No, CVE-2022-23227 allows attackers to exploit the vulnerability without any authentication.