Vulnerability Description
NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nuuo | Nvrmini2 Firmware | <= 3.11.0 |
| Nuuo | Nvrmini2 | - |
Related Weaknesses (CWE)
References
- https://github.com/pedrib/PoC/blob/master/advisories/NUUO/nuuo_nvrmini_round2.mkExploitThird Party Advisory
- https://github.com/rapid7/metasploit-framework/pull/16044ExploitIssue TrackingThird Party Advisory
- https://news.ycombinator.com/item?id=29936569Third Party Advisory
- https://portswigger.net/daily-swig/researcher-discloses-alleged-zero-day-vulneraExploitThird Party Advisory
- https://github.com/pedrib/PoC/blob/master/advisories/NUUO/nuuo_nvrmini_round2.mkExploitThird Party Advisory
- https://github.com/rapid7/metasploit-framework/pull/16044ExploitIssue TrackingThird Party Advisory
- https://news.ycombinator.com/item?id=29936569Third Party Advisory
- https://portswigger.net/daily-swig/researcher-discloses-alleged-zero-day-vulneraExploitThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-US Government Resource
FAQ
What is CVE-2022-23227?
CVE-2022-23227 is a vulnerability with a CVSS score of 9.8 (CRITICAL). NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authenticatio...
How severe is CVE-2022-23227?
CVE-2022-23227 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2022-23227?
Check the references section above for vendor advisories and patch information. Affected products include: Nuuo Nvrmini2 Firmware, Nuuo Nvrmini2.