CVE-2022-23227

Known Exploited Vulnerability

NUUO NVRmini2 Devices Missing Authentication Vulnerability

Vendor / product: NUUO / NVRmini2 Devices

Description

NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root.

Weakness classification

• CWE-306: Missing Authentication for Critical Function

Primary references

• cve@mitre.org — Exploit, Third Party Advisory
• cve@mitre.org — Exploit, Issue Tracking, Third Party Advisory
• cve@mitre.org — Third Party Advisory
• cve@mitre.org — Exploit, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Issue Tracking, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
• 134c704f-9b21-4f2e-91b3-4a467353bcc0 — US Government Resource