All vulnerabilities
CVE-2022-23227

NUUO NVRmini2 Devices Missing Authentication Vulnerability

NUUO NVRmini2 Devices
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationExploited in the wildAdded to KEV 18 Dec 2024CISA KEV
Exploit odds (EPSS)48.5%Chance of exploitation activity in the next 30 days, higher than 98% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Federal deadline8 Jan 2025Remediation due date for US federal agenciesCISA KEV
CISA required actionThe impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product. CISA KEV

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Timeline

  1. 14 Jan 2022, 17:13 UTCPublishedCVE List
  2. 18 Dec 2024Added to CISA KEVCISA KEV

Description

NUUO NVRmini2 devices contain a missing authentication vulnerability that allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users.

Text from CVE List

Affected versions 1

  • n/aaffected: n/aCVE List

References 7