CVE-2022-23227

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 48,5%

Kerentanan Missing Authentication for Critical Function pada nuuo nvrmini2 firmware. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 18 Desember 2024, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root.

Rincian

Terbit di NVD

14 Januari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

48,5% peluang dieksploitasi; lebih tinggi dari 98,8% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

NUUO NVRmini2 Devices Missing Authentication Vulnerability

Masuk KEV

18 Desember 2024

Tenggat CISA

8 Januari 2025 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-23227 pemerintah AS
• https://github.com/pedrib/PoC/blob/master/advisories/NUUO/nuuo_nvrmini_round2.mkd exploit · advisory pihak ketiga
• https://github.com/rapid7/metasploit-framework/pull/16044 exploit · issue tracking · advisory pihak ketiga
• https://news.ycombinator.com/item?id=29936569 advisory pihak ketiga
• https://portswigger.net/daily-swig/researcher-discloses-alleged-zero-day-vulnerabilities-in-nuuo-nvrmini2-reco... exploit · advisory pihak ketiga