Critical severity · published Jan 14, 2022
CVE-2022-23227
NUUO NVRmini2 Devices Missing Authentication Vulnerability
In wildKEV
9.8
CVSS
48.5%
EPSS
Yes
On KEV
Description
NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)48.5% · higher than 99% of CVEs
Exploited in the wildYes
CISA KEVListed Dec 18, 2024
Federal remediation dueJan 8, 2025
Ransomware campaign useNot known
Affected products
Which versions
NF
Nvrmini2 Firmware · Nuuo
through 3.11.0 · source: NVD
ND
NVRmini2 Devices · NUUO
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-23227
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-23227
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_MISC
https://github.com/pedrib/PoC/blob/master/advisories/NUUO/nuuo_nvrmini_round2.mkd
x_refsource_MISC
https://github.com/rapid7/metasploit-framework/pull/16044
x_refsource_MISC
https://portswigger.net/daily-swig/researcher-discloses-alleged-zero-day-vulnerabilities-in-nuuo-nvrmini2-recording-device
x_refsource_MISC
https://news.ycombinator.com/item?id=29936569
More from Nvrmini2 Firmware
9.8
CVE-2018-19864
NUUO NVRmini2 Network Video Recorder firmware through 3.9.1 allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow), resulting in ability…
9.8
CVE-2018-1149
cgi_system in NUUO's NVRMini2 3.8.0 and below allows remote attackers to execute arbitrary code via crafted HTTP requests
8.8
CVE-2018-15716
NUUO NVRMini2 version 3.9.1 is vulnerable to authenticated remote command injection
7.3
CVE-2018-1150
NUUO's NVRMini2 3.8.0 and below contains a backdoor that would allow an unauthenticated remote attacker to take over user accounts if the file /tmp/moses exists