CVE-2022-23227

nuuo nvrmini2 firmware

Published 14 Jan 2022 · updated 17 Jun 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 18 Dec 2024, with a remediation deadline of 8 Jan 2025 for US federal agencies.

Required action: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

Description

NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root.

References

github.com/pedrib/PoC/blob/master/advisories/NUUO/nuuo_nvrmini_round2.mkd · Exploit, Third Party Advisory
github.com/rapid7/metasploit-framework/pull/16044 · Exploit, Issue Tracking, Third Party Advisory
news.ycombinator.com/item?id=29936569 · Third Party Advisory
portswigger.net/daily-swig/researcher-discloses-alleged-zero-day-vulnerabilities-in-nuuo-nvrmini2-recording-device · Exploit, Third Party Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-23227 · US Government Resource