Missing Authentication in NUUO NVRmini2 Devices (CVE‑2022‑23227) Enables Unauthorized User Creation
What It Is
NUUO NVRmini2 network video recorders contain a missing‑authentication flaw that permits any unauthenticated network actor to upload an encrypted .tar archive. The archive can be crafted to create arbitrary local user accounts, effectively granting the attacker persistent access to the device’s management interface.
Exploitability
The vulnerability is remotely exploitable without credentials. Public proof‑of‑concept code has not been released, but the attack vector is straightforward (HTTP/HTTPS upload endpoint) and the CVSS base score is rated High by CISA. Because exploitation requires only network reachability, the risk is considered active.
Affected Products
- Vendor: NUUO
- Product line: NVRmini2 series (all firmware versions prior to the vendor‑issued patch)
Why It Matters for Compliance & Audit Readiness
Control‑assurance programs rely on demonstrable access‑control integrity and vendor‑management diligence. An unauthenticated path to create privileged accounts undermines:
- Access‑Control Policies – the device can bypass least‑privilege rules, creating audit gaps.
- Continuous Monitoring – unauthorized accounts may not generate standard alerts, eroding evidence of effective monitoring.
- Vendor‑Management Controls – failure to track and remediate known vendor‑issued vulnerabilities can be cited as a lapse in due‑diligence during audits (e.g., ISO 27001 A.12.6, NIST CSF PR.IP‑1).
Documenting the vulnerability, the remediation timeline, and the evidence of applied patches strengthens the audit trail and supports a defensible posture under regulatory frameworks such as GDPR, HIPAA, or PCI‑DSS.
Recommended Actions
- Inventory all NUUO NVRmini2 units and map them to the “Access Control” and “Vendor Management” control families.
- Apply the latest firmware released by NUUO that addresses CVE‑2022‑23227; verify version numbers against vendor advisories.
- Restrict inbound network traffic to the device’s management ports (e.g., enforce firewall rules, VPN‑only access).
- Enable logging of authentication‑related events and integrate logs into a SIEM for continuous monitoring.
- Conduct a post‑remediation audit: capture screenshots of the updated firmware version, export configuration baselines, and store evidence in your control‑assurance repository.
- Update vendor‑risk assessments to reflect the remediation status and any residual risk.
Source: CISA KEV – CVE‑2022‑23227