CVE-2022-23227criticalunder attackCWE-306

CVE-2022-23227

Published · Updated

Follow this CVE+ Monitor NVRmini2 Devices

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

90Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 9.8epss 48%
from disclosure to weapon496 days
Published on NVDJan 14
1st PoC+496d
CISA KEV+1069d
Action required by CISAfederal deadline: 2025-01-08

The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

In short

An unauthenticated attacker can upload a malicious TAR file to NUUO NVRmini2 recorders without logging in, allowing them to create unauthorized users and potentially gain complete control of the system.

Technical detail

The vulnerability stems from missing authentication in handle_import_user.php, permitting unauthenticated TAR archive uploads. When chained with CVE-2011-5325 (arbitrary file overwrite), an attacker can achieve arbitrary file write under the web root and execute commands as root.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.