{"id":"CVE-2022-23227","aliases":["EUVD-2022-28314","GHSA-5f63-p3w5-jphc"],"status":"published","title":"NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive,...","description":"NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.48497,"percentile":0.98879,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":false,"fix_available":false},"cwes":["CWE-306"],"published":"2022-01-14T17:13:57Z","modified":"2026-06-17T04:29:42Z","kev":{"date_added":"2024-12-18","due_date":"2025-01-08","required_action":"The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2024-12-18"},{"source":"kev","since":"2024-12-18"}],"products":[{"vendor":"nuuo","product":"nvrmini2 devices"},{"vendor":"nuuo","product":"nvrmini2_firmware"}],"references":[{"url":"https://github.com/pedrib/PoC/blob/master/advisories/NUUO/nuuo_nvrmini_round2.mkd","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://github.com/rapid7/metasploit-framework/pull/16044","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory"]},{"url":"https://portswigger.net/daily-swig/researcher-discloses-alleged-zero-day-vulnerabilities-in-nuuo-nvrmini2-recording-device","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://news.ycombinator.com/item?id=29936569","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-23227","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23227"},{"url":"https://github.com/advisories/GHSA-5f63-p3w5-jphc"}],"sources":{"cve":[{"id":"CVE-2022-23227","description":"NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root.","status":"published","published":"2022-01-14T17:13:57Z","modified":"2025-10-21T23:15:48.977Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:34:29.478363Z"}],"euvd":[{"id":"EUVD-2022-28314","description":"NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root.","status":"published","published":"2022-01-14T17:13:57Z","modified":"2025-10-21T23:15:48Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2024-12-18","updated_at":"2026-11-02T20:31:25.901288Z"}],"ghsa":[{"id":"GHSA-5f63-p3w5-jphc","title":"NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive,...","description":"NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root.","status":"published","published":"2022-01-15T00:01:39Z","modified":"2025-10-22T00:32:28Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T15:04:05.344883Z"}],"kev":[{"id":"CVE-2022-23227","title":"NUUO NVRmini2 Devices Missing Authentication Vulnerability ","description":"NUUO NVRmini2 devices contain a missing authentication vulnerability that allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users. ","cwes":["CWE-306"],"kev":{"date_added":"2024-12-18","due_date":"2025-01-08","required_action":"The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2022-23227","description":"NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root.","status":"published","published":"2022-01-14T18:15:10.303Z","modified":"2026-06-17T04:29:42.067Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:07:10.836864Z"}]}}