ACTIVELY EXPLOITED
CVE-2022-23227: NUUO NVRmini2 Devices Missing Authentication Vulnerability
| Vendor | NUUO |
|---|---|
| Product | NVRmini2 Devices |
| Actively exploited | Yes |
| Added to CISA KEV | 18 Dec 2024 |
| CISA federal deadline | 8 Jan 2025 |
| Weakness (CWE) | CWE-306 |
Required action (CISA's text)
The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
Description (NVD)
NUUO NVRmini2 devices contain a missing authentication vulnerability that allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users.
SOURCES
Other NUUO flaws
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.