---
id: "CVE-2022-23227"
kind: "vulnerability"
aliases: ["CVE-2022-23227"]
title: "nuuo nvrmini2 firmware: NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be\u2026"
severity: "critical"
cvss: 10.0
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "NUUO NVRmini2 Devices", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "nuuo nvrmini2 firmware", "fixed": [], "affected": "<= 3.11.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "nuuo", "nvrmini2", "self-hosted", "video-surveillance"]
not_affected_if: ["no-nuuo-nvrmini2-devices"]
published_at: "2022-01-14T18:15:10+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-23227", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23227", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# nuuo nvrmini2 firmware: NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be…

NUUO NVRmini2 network video recorders have a missing authentication check that lets an unauthenticated attacker upload an encrypted TAR archive. That archive can be abused to add arbitrary user accounts on the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:NUUO NVRmini2 Devices affected ? fixed ?
- vendor:nuuo nvrmini2 firmware affected <= 3.11.0 fixed ?

## How to check

Identify any NUUO NVRmini2 devices on the network and confirm the model.

## Fix

Discontinue use of the NVRmini2 device, since CISA reports the product is end-of-life and end-of-service and no fix is listed in the sources.
Isolate any remaining device from the internet and untrusted network segments.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-23227
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2022-23227

## From the sources

NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_