CVE-2022-23227: NUUO NVRmini2 Devices Missing Authentication Vulnerability

CVE-2022-23227 is a missing authentication vulnerability in NUUO NVRmini2 devices. An unauthenticated attacker can upload an encrypted TAR archive that can be abused to add arbitrary users. Because these network video recorders often sit on internal networks and hold video feeds or device credentials, successful abuse can give an outsider persistent control of the appliance and a foothold for further movement. The product is end-of-life and end-of-service, so the only durable fix is to stop using it.

Security teams should treat any internet-facing or poorly segmented NVRmini2 instance as high priority for discovery and removal. Confirm all technical details against the vendor advisory and CISA guidance before acting.

How it works

The weakness is CWE-306: Missing Authentication for Critical Function. The device exposes a function that accepts an encrypted TAR archive without first verifying the caller’s identity. An attacker who can reach that interface can supply a crafted archive; the device processes it and the contents can be used to create new user accounts. Once those accounts exist, the attacker can log in with full privileges, change configuration, view or delete recordings, and potentially pivot to other systems that trust the NVR. No further exploit mechanics are required for understanding the risk; the core issue is the complete absence of authentication on a privileged upload path.

Am I affected? How to find it in your systems

NUUO NVRmini2 appliances are typically deployed as dedicated network video recorders for small-to-medium surveillance systems. They commonly appear on the same VLAN as cameras, on management networks, or occasionally with direct internet exposure for remote viewing.

• Inventory: search asset databases, DHCP leases, and network scans for devices identifying as NUUO NVRmini2 or related NUUO firmware banners. Check web interfaces on common ports used by NVR appliances.
• Version and configuration: because the product is end-of-life, any remaining unit is considered affected. Confirm the exact model and firmware against the vendor advisory; do not rely on assumed version ranges.
• Telemetry signs: look for unexpected user-account creation events, uploads of TAR archives, or authentication successes from unfamiliar source addresses in the device logs. Network monitoring may show unsolicited connections to the NVR’s management interface followed by archive transfers.

If the device is still reachable from untrusted networks, treat it as exposed until proven otherwise.

How to remediate

The CISA-required action is clear: the product is end-of-life and end-of-service. Discontinue utilization of the NUUO NVRmini2. Replace it with a supported NVR platform that receives security updates. After replacement, wipe or securely decommission the old unit so residual credentials and recordings cannot be recovered. Until replacement is complete, isolate the device and apply the compensating controls listed below. Always cross-check the latest vendor advisory for any residual guidance, but do not expect a patch for an EoL product.

If you can't patch immediately

Because no patch will be issued, compensating controls must reduce the attack surface until the device can be retired.

• Network segmentation: place the NVR on a dedicated VLAN with strict firewall rules that allow only necessary camera and management traffic from trusted hosts. Block all inbound access from the internet and from general user networks.
• Access restriction: disable any remote-viewing or cloud-connectivity features if they are not required. Limit management access to a jump host or bastion that itself is tightly controlled.
• Monitoring and virtual patching: deploy network IDS/IPS or a WAF in front of the device to detect and block unauthenticated TAR uploads or anomalous account-creation traffic. Alert on any new user accounts or configuration changes.
• Credential hygiene: if the device still has known default or shared accounts, change them immediately and document the new credentials in a secure vault. Rotate any credentials that cameras or other systems share with the NVR.

These measures only buy time; plan the full decommissioning as soon as possible.

If your data may have been exposed

Actively exploited missing-authentication flaws on network appliances frequently lead to unauthorized access and data exposure. Review NVR logs and connected camera systems for signs of unauthorized accounts or unusual activity. If you believe credentials or video data may have left the environment, treat the incident according to your breach-response process. As a quick additional check, you can run a free exposure scan of your email addresses against known breach data sets to see whether related accounts have already appeared in public dumps.