CVE-2022-23227 NUUO NVRmini2 Devices Missing Authentication Vulnerability

Exploited in the wild Critical 9.8 Published 14 Jan 2022 Updated 21 Oct 2025

Unauthenticated attackers can upload user archives to create accounts, potentially leading to root code execution when combined with another vulnerability.

Exploited in the wild: Since 18 Dec 2024
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-23227?

CVE-2022-23227 is a critical missing authorization vulnerability in n/a, published on 14 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root.

Weakness: CWE-306

Which versions are affected by CVE-2022-23227?

It affects 1 product.

Products include Nuuo Nvrmini2 Firmware.

How do I fix CVE-2022-23227?

No fix has been published for CVE-2022-23227 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 8 Jan 2025.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2022-23227 being exploited?

Yes. Attackers have exploited CVE-2022-23227 in the wild since at least 18 Dec 2024.

Sources

Also known as GHSA-5f63-p3w5-jphc.