Live › vulnerability › CVE-2022-23227
Go to dashboardNUUO NVRmini2 network video recorders have a missing authentication check that lets an unauthenticated attacker upload an encrypted TAR archive. That archive can be abused to add arbitrary user accounts on the device.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| NUUO NVRmini2 Devices | vendor | – | – |
| nuuo nvrmini2 firmware | vendor | <= 3.11.0 | – |
Identify any NUUO NVRmini2 devices on the network and confirm the model.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root.
This page as .md · .json · in your agent: get_signal("CVE-2022-23227")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.