by Kastro
Paper/Archive/CVE-2022-23227

CVE-2022-23227

NUUO NVRmini2 Devices — NUUO NVRmini2 Devices Missing Authentication Vulnerability

KEV · due 8 JanEPSS 48%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (ADP)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 98.9.989 × 2019.8Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refnews.ycombinator.com/item?id=29936569refgithub.com/pedrib/PoC/blob/master/advisories/NUUO/nuuo_nvrmini_round2.mkdrefgithub.com/rapid7/metasploit-framework/pull/16044refportswigger.net/daily-swig/researcher-discloses-alleged-zero-day-vulnerabilities-in-nuuo-nvrmini2-recording-devicerefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-23227kevcisa.gov/known-exploited-vulnerabilities-catalog