CVE-2022-23227 · netVigilance record NV24-0183
NUUO NVRmini2 Devices Missing Authentication
past due
What to do
The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
CISA deadline 2025-01-08 · passed 1 year 8 months ago · applies to US federal civilian agencies; used elsewhere as a reference SLA
What happened
NUUO NVRmini2 devices contain a missing authentication vulnerability that allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users.
Who is affected
NUUO NVRmini2 Devices. Affected version ranges are listed in the vendor advisory and the NVD entry linked under Sources.
Weakness class: CWE-306.
Timeline
- Added to CISA KEVExploitation in the wild confirmed by CISA
- CISA remediation deadlinepassed 1 year 8 months ago
Sources
- NVD entry for CVE-2022-23227 nvd.nist.gov/vuln/detail/CVE-2022-23227
- CISA Known Exploited Vulnerabilities catalog www.cisa.gov/known-exploited-vulnerabilities-catalog
- nuuo.com nuuo.com/wp-content/uploads/2023/03/NUUO-EOL-letter＿NVRmini-2-and-NVRsolo-series.pdf
- nvd.nist.gov nvd.nist.gov/vuln/detail/CVE-2022-23227