CVE-2022-23227—NUUO NVRmini2 Devices Missing Authentication Vulnerability

Vulnerability Name

NUUO NVRmini2 Devices Missing Authentication Vulnerability

Description

NUUO NVRmini2 devices contain a missing authentication vulnerability that allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users.

Known To Be Used in Ransomware Campaigns?

Ransomware Status:

Unknown

Action

The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

Additional Notes

• https://nuuo.com/wp-content/uploads/2023/03/NUUO-EOL-letter＿NVRmini-2-and-NVRsolo-series.pdf
• https://nvd.nist.gov/vuln/detail/CVE-2022-23227

Related Weaknesses

• CWE-306