logo

CVE-2022-23227 - NUUO NVRmini 2 Devices Missing Authentication Vulnerability

CVE-2022-23227

NUUO | NVRmini2 Devices

  • Date Added:
  • 2024-12-18
  • Due Date:
  • 2025-01-08
Vulnerability Name

NUUO NVRmini 2 Devices Missing Authentication Vulnerability

Description

NUUO NVRmini 2 devices contain a missing authentication vulnerability that allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

Additional Notes
https://nuuo.com/wp-content/uploads/2023/03/NUUO-EOL-letter＿NVRmini-2-and-NVRsolo-series.pdf ; https://nvd.nist.gov/vuln/detail/CVE-2022-23227

Free security scan for your website