CVE-2022-23227
NUUO NVRmini2 Devices Missing Authentication Vulnerability
Description
CVE-2022-23227 is a critical authentication bypass vulnerability in NUUO NVRmini2 network video recorder devices through firmware version 3.11. The flaw allows an unauthenticated attacker to upload an encrypted TAR archive through the handle_import_user.php endpoint, which lacks authentication controls. When combined with a separate path traversal flaw (CVE-2011-5325), an attacker can overwrite arbitrary files under the web root and achieve remote code execution as root. With a CVSS v3.1 base score of 9.8 and an EPSS score of 46.99% at the 97.6th percentile, this is one of the most dangerous NVR vulnerabilities. CISA has added CVE-2022-23227 to the Known Exploited Vulnerabilities catalog with a remediation deadline of January 8, 2025.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| nuuo | nvrmini2 firmware | <= 3.11.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/pedrib/PoC/blob/master/advisories/NUUO/nuuo_nvrmini_round2.mkd(Exploit, Third Party Advisory)
- https://github.com/rapid7/metasploit-framework/pull/16044(Exploit, Issue Tracking, Third Party Advisory)
- https://news.ycombinator.com/item?id=29936569(Third Party Advisory)
- https://portswigger.net/daily-swig/researcher-discloses-alleged-zero-day-vulnerabilities-in-nuuo-nvrmini2-recording-device(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-23227(US Government Resource)
Weakness Type
Authentication Bypass in User Import Functionality
CVE-2022-23227 is an improper access control vulnerability in the NUUO NVRmini2's user import functionality. The handle_import_user.php script, which processes uploaded TAR archives containing user configurations, fails to enforce any authentication check before accepting and processing uploads. This means any unauthenticated remote attacker can submit files to this endpoint. The vulnerability is compounded by the ability to chain it with CVE-2011-5325, a directory traversal flaw in BusyBox's tar implementation, allowing the uploaded archive to write files to arbitrary locations on the filesystem. Together, these weaknesses enable complete unauthenticated remote code execution by uploading a malicious archive that places a web shell or other executable content under the web root directory.
Impact Analysis
The impact of CVE-2022-23227 is maximum across all CIA triad dimensions. Confidentiality is fully compromised because unauthenticated file upload combined with arbitrary file write and code execution grants complete access to the NVR's stored video recordings, camera feeds, network configurations, user credentials, and any other data on the device. NVRmini2 devices typically manage multiple surveillance cameras, meaning a single compromise exposes all connected camera feeds and historical recordings.
Integrity faces catastrophic impact as the attacker can overwrite any file on the system, modify recordings, tamper with evidence, alter device configurations, and install persistent backdoors. The ability to achieve code execution as root means the attacker has unrestricted control over the device and can modify its behavior at every level.
Availability is maximally impacted since root-level code execution allows the attacker to disable recording, shut down the device, corrupt the filesystem, or render the NVR permanently inoperable. The attack is network-accessible (AV:N) with low complexity (AC:L), requires no authentication (PR:N) and no user interaction (UI:N), making it trivially exploitable by any attacker with network access to the device. The EPSS score of 46.99% at the 97.6th percentile indicates very high exploitation probability. Multiple public exploit resources and a Metasploit module exist, further confirming widespread exploitation capability.
Exploit Maturity
CVE-2022-23227 has extremely high exploit maturity with multiple publicly available exploits and automated exploitation tools. A detailed proof-of-concept advisory documents the complete exploitation chain. A Metasploit module has been developed, integrating this vulnerability into the most widely used penetration testing framework and making automated exploitation accessible to a broad range of attackers.
CISA has confirmed active exploitation by adding it to the Known Exploited Vulnerabilities catalog. The EPSS score of 46.99% at the 97.6th percentile places it among the most exploited vulnerabilities tracked. The exploit chain is particularly effective because it requires zero authentication and achieves root-level code execution through a straightforward two-step process: upload a crafted TAR archive and trigger the path traversal to write a web shell. The vulnerability was also covered by PortSwigger's Daily Swig, highlighting the disclosure as a zero-day. While CISA lists the ransomware association as unknown, NVR devices on enterprise networks represent valuable targets for both surveillance compromise and as network entry points for broader attacks.
Remediation
-
Update NVRmini2 firmware immediately. Check NUUO's support channels for firmware versions newer than 3.11 that address the authentication bypass in handle_import_user.php. If no patched firmware is available, consider replacing the device with a supported alternative, as NUUO has a history of slow vulnerability remediation.
-
Isolate NVRmini2 devices from untrusted networks immediately. As a critical compensating control, block all internet access to the NVRmini2 management interface. Place the device on a dedicated surveillance VLAN with firewall rules that restrict access to only authorized management stations and camera IP addresses.
-
Conduct forensic analysis of exposed devices. Any NVRmini2 device that was accessible from untrusted networks should be considered potentially compromised. Examine the web root directory for unauthorized files such as web shells, review system logs for evidence of exploitation, and check for persistent backdoors or modified system files.
-
Implement network-level monitoring and access controls. Deploy intrusion detection signatures for the known exploit patterns targeting handle_import_user.php. Monitor for unusual HTTP POST requests to the NVR's management interface, unexpected outbound connections, and abnormal file system activity on the device.
-
Evaluate replacement of end-of-life NVR hardware. If NUUO has not released a patch for CVE-2022-23227, consider migrating to a supported NVR platform with an active security response program. Continuing to operate unpatched NVR devices with critical unauthenticated RCE vulnerabilities poses unacceptable risk to the surveillance infrastructure and broader network.
Technical Details
CVE-2022-23227 is a critical authentication bypass and arbitrary file upload vulnerability in NUUO NVRmini2 devices. The CVSS v3.1 vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, representing maximum practical severity for an unchanged-scope vulnerability.
The vulnerability exists in the handle_import_user.php script on the NVRmini2 web interface. This PHP script is designed to process user configuration imports via uploaded TAR archives. The critical flaw is that the script performs no authentication check before accepting and processing the uploaded file. Any remote attacker can send an HTTP POST request to this endpoint with a crafted TAR archive, and the server will accept and extract it.
The exploitation chain combines this authentication bypass with CVE-2011-5325, a path traversal vulnerability in BusyBox's tar utility. BusyBox is the embedded Linux toolkit used on the NVRmini2, and its tar implementation fails to properly sanitize path components in archive entries. By crafting a TAR archive with directory traversal sequences (e.g., ../../) in the file paths, an attacker can write files to arbitrary locations on the filesystem, including the web root directory.
The complete attack flow is: (1) craft a TAR archive containing a PHP web shell with path traversal in its filename targeting the web root, (2) upload the archive to handle_import_user.php without authentication, (3) the server extracts the archive using vulnerable BusyBox tar, placing the web shell in the web root, and (4) access the web shell via HTTP to execute arbitrary commands as root. The entire chain can be automated, as demonstrated by the available Metasploit module. Affected versions include all NVRmini2 firmware through version 3.11.
Frequently Asked Questions
What is CVE-2022-23227?
CVE-2022-23227 is a critical authentication bypass vulnerability in NUUO NVRmini2 network video recorders. It allows unauthenticated attackers to upload malicious TAR archives that, when combined with a path traversal flaw, enable arbitrary file writes and remote code execution as root.
Can CVE-2022-23227 be exploited without authentication?
Yes. The vulnerability requires no authentication whatsoever. The affected endpoint, handle_import_user.php, accepts file uploads from any remote attacker without verifying credentials, making it exploitable by anyone with network access to the device.
Is there a Metasploit module for this vulnerability?
Yes. A Metasploit module has been developed for CVE-2022-23227, which automates the complete exploit chain from unauthenticated file upload through path traversal to remote code execution. This makes exploitation accessible even to less skilled attackers.
What should organizations do if their NVRmini2 was internet-accessible?
Any internet-exposed NVRmini2 running firmware 3.11 or earlier should be treated as compromised. Conduct a forensic investigation, check for web shells and backdoors, isolate the device immediately, and plan for replacement if no firmware patch is available from NUUO.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.