NUUO NVRmini2 Unauthenticated User Creation and Remote Code Execution (CVE-2022-23227)
Executive & SecOps Summary
SECOPS ASSESSMENTNUUO NVRmini2 firmware versions up to and including 3.11.
Unauthenticated attackers can add arbitrary users and, when chained with CVE-2011-5325, overwrite files under the web root to execute arbitrary code as root.
Immediately restrict external access to the device, apply the latest firmware updates, or implement strict access control lists.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Verify the current firmware version of your NUUO NVR device and apply the latest security patches provided by the vendor. You can check the active version via SSH:
# Access the NVR CLI via SSH and check the firmware version
cat /etc/version
# Alternatively, inspect system release details
cat /etc/issue2. Temporary Workaround & Hardening Configuration
If patching is not immediately feasible, block external access to the vulnerable endpoint using a reverse proxy or firewall rules. Below is an example configuration for Nginx:
# Nginx reverse proxy configuration to block the vulnerable endpoint
server {
listen 80;
server_name nvr.local;
# Block access to the vulnerable user import script
location ~* /handle_import_user.php {
deny all;
return 403;
}
}3. Log Audit & IoC Verification Commands
Scan web server access logs for unauthorized POST requests targeting the vulnerable endpoint and inspect the web root for suspicious files:
# Search access logs for requests to handle_import_user.php
grep 'handle_import_user.php' /var/log/httpd/access_log /var/log/nginx/access.log 2>/dev/null
# Identify recently modified or created PHP files in the web directory
find /var/www/ -name '*.php' -mtime -30 -printStop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability arises due to a missing authentication check (CWE-306) in the handle_import_user.php endpoint of NUUO NVRmini2 network video recorders. An unauthenticated remote attacker can exploit this flaw by uploading a specially crafted, encrypted TAR archive to force the registration of arbitrary users into the system.
2. Exploitation Mechanics & Attack Scenario
An attacker targets the handle_import_user.php endpoint directly without establishing a valid session. When this action is combined with a directory traversal vulnerability (CVE-2011-5325), the extraction process of the uploaded TAR archive can be manipulated to overwrite arbitrary files within the web root. This allows the attacker to plant a malicious PHP web shell and achieve remote code execution (RCE) with root privileges.
3. Infrastructure & Business Impact
With a CVSS score of 9.8 (Critical), this vulnerability is actively exploited in the wild and is listed in the CISA KEV catalog. Successful exploitation grants full administrative control over the NVR device, enabling attackers to intercept surveillance feeds, pivot into internal networks, or deploy ransomware.
Official Vendor Advisories & References
NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root.
Frequently Asked SecOps Questions (CVE-2022-23227)
FAQQ1. How critical is CVE-2022-23227 and is it actively exploited in the wild?
CVE-2022-23227 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 48.5%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2022-23227?
Primary impacted vendors include nuuo across nvrmini2. Scope summary: All NUUO NVRmini2 firmware versions 3.11 and prior
Q3. What temporary mitigations or workarounds exist for CVE-2022-23227 before patching?
[Mitigation] Immediately restrict external access to the device, apply the latest firmware updates, or implement strict access control lists. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2022-23227
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (nuuo)
View Category →TrueConf Server Unauthenticated Remote Code Execution (RCE) Vulnerability Security Advisory (CVE-2026-72529)
[Affected Scope] TrueConf Server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier
MikroTik RouterOS Authentication Bypass, Kernel Panic, and Info Leak (CVE-2026-67277) Security Advisory
[Affected Scope] MikroTik RouterOS versions 6.x and 7.x prior to specific patched releases.
Arista VeloCloud Orchestrator (VCO) Remote Code Execution and Privilege Escalation (CVE-2026-93952)
[Affected Scope] Arista VeloCloud Orchestrator (VCO) On-premise deployments.
Cisco Identity Services Engine (ISE) Critical Authentication Bypass Vulnerability (CVE-2026-76460)
[Affected Scope] Cisco Identity Services Engine (ISE) web-based management interface and API endpoints.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.