CVE-2022-23227

NUUO NVRmini2 network video recorders fail to require authentication for a remote archive-upload function, so an unauthenticated attacker can upload a specially crafted encrypted TAR archive to the device. By abusing this mechanism, the attacker can add arbitrary user accounts, gaining authenticated access to the NVR's management and surveillance features. Any organization still running a NUUO NVRmini2 appliance is affected; the product line is end-of-life/end-of-service and no longer receiving fixes. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-12-18, indicating exploitation in the wild, though ransomware use has not been confirmed. EPSS assigns a roughly 48.5% probability of exploitation within 30 days (99th percentile), and CISA's required action is to discontinue use of the product.

What to do: Because the product is end-of-life/end-of-service and no patch is available, retire or replace NVRmini2 appliances as CISA's KEV required action directs. If replacement is not immediate, remove the device's web interface from direct internet exposure (restrict via firewall/ACL or VPN) and audit device accounts and logs for unexpectedly added users.