CVE-2022-23227
NUUO · exploited in the wild
- Published
- 14 January 2022
- Last modified
- 17 June 2026
- CVSS
- 9.8 v3.1
- Severity
- critical
- EPSS
- 49.4% (99th pct)
- CISA KEV
- Added 18 December 2024 KEV
- NVD status
- Analyzed
- Weaknesses
- CWE-306
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root.
Exploitation
Added to the CISA Known Exploited Vulnerabilities catalogue on 18 December 2024, with a remediation due date of 8 January 2025 for US federal civilian agencies. CISA records no known ransomware campaign use.
Required action as published by CISA: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
Affected products
| Product | Vendor | Type | Versions named |
|---|---|---|---|
| NVRMINI2 | NUUO | unknown | 3.9.1, <= 3.11.0, <= 3.8.0, <= 3.9.1 |
References
- https://github.com/pedrib/PoC/blob/master/advisories/NUUO/nuuo_nvrmini_round2.mkd exploit
- https://github.com/rapid7/metasploit-framework/pull/16044 exploit
- https://news.ycombinator.com/item?id=29936569 third-party
- https://portswigger.net/daily-swig/researcher-discloses-alleged-zero-day-vulnerabilities-in-nuuo-nvrmini2-recording-device exploit
- https://github.com/pedrib/PoC/blob/master/advisories/NUUO/nuuo_nvrmini_round2.mkd exploit
- https://github.com/rapid7/metasploit-framework/pull/16044 exploit
- https://news.ycombinator.com/item?id=29936569 third-party
- https://portswigger.net/daily-swig/researcher-discloses-alleged-zero-day-vulnerabilities-in-nuuo-nvrmini2-recording-device exploit
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-23227 government
Record assembled from NVD, CISA KEV 2026.09.04 and FIRST EPSS 2026-09-04. Affected products are those NVD's CPE configuration names that fall inside this site's scope; a CVE may affect products outside it.