Sign-up

ID

VAR-202201-2026


CVE

CVE-2022-23227


TITLE

NUUO NVRmini2  Vulnerability regarding lack of authentication for critical features in

Trust: 0.8

sources: JVNDB: JVNDB-2022-003358

DESCRIPTION

NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root. NUUO NVRmini2 There is a vulnerability in the lack of authentication for critical features.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. NUUO NVRMini2 is a small network hard disk video recorder device from Taiwan NUUO company

Trust: 2.25

sources: NVD: CVE-2022-23227 // JVNDB: JVNDB-2022-003358 // CNVD: CNVD-2022-70105 // VULMON: CVE-2022-23227

IOT TAXONOMY

category:['IoT']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2022-70105

AFFECTED PRODUCTS

vendor:nuuomodel:nvrmini2scope:lteversion:3.11.0

Trust: 1.0

vendor:nuuomodel:nvrmini 2scope:eqversion: -

Trust: 0.8

vendor:nuuomodel:nvrmini 2scope:eqversion:nuuo nvrmini 2 firmware 3.11 to

Trust: 0.8

vendor:nuuomodel:nvrmini2scope:ltversion:03.11.0000.0005

Trust: 0.6

sources: CNVD: CNVD-2022-70105 // JVNDB: JVNDB-2022-003358 // NVD: CVE-2022-23227

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-23227
value: CRITICAL

Trust: 1.0

134c704f-9b21-4f2e-91b3-4a467353bcc0: CVE-2022-23227
value: CRITICAL

Trust: 1.0

NVD: CVE-2022-23227
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2022-70105
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202201-1329
value: CRITICAL

Trust: 0.6

VULMON: CVE-2022-23227
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2022-23227
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2022-70105
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2022-23227
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 2.0

NVD: CVE-2022-23227
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2022-70105 // VULMON: CVE-2022-23227 // JVNDB: JVNDB-2022-003358 // CNNVD: CNNVD-202201-1329 // NVD: CVE-2022-23227 // NVD: CVE-2022-23227

PROBLEMTYPE DATA

problemtype:CWE-306

Trust: 1.0

problemtype:Lack of authentication for critical features (CWE-306) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-003358 // NVD: CVE-2022-23227

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202201-1329

TYPE

access control error

Trust: 0.6

sources: CNNVD: CNNVD-202201-1329

PATCH

title:Top Pageurl:https://www.nuuo.com/

Trust: 0.8

title:Patch for NUUO NVRmini2 Authorization Issue Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/358241

Trust: 0.6

title:CVE-2022-XXXXurl:https://github.com/AlphabugX/CVE-2022-23305

Trust: 0.1

title:CVE-2022-XXXXurl:https://github.com/AlphabugX/CVE-2022-RCE

Trust: 0.1

sources: CNVD: CNVD-2022-70105 // VULMON: CVE-2022-23227 // JVNDB: JVNDB-2022-003358

EXTERNAL IDS

db:NVDid:CVE-2022-23227

Trust: 3.9

db:JVNDBid:JVNDB-2022-003358

Trust: 0.8

db:CNVDid:CNVD-2022-70105

Trust: 0.6

db:CNNVDid:CNNVD-202201-1329

Trust: 0.6

db:VULMONid:CVE-2022-23227

Trust: 0.1

sources: CNVD: CNVD-2022-70105 // VULMON: CVE-2022-23227 // JVNDB: JVNDB-2022-003358 // CNNVD: CNNVD-202201-1329 // NVD: CVE-2022-23227

REFERENCES

url:https://portswigger.net/daily-swig/researcher-discloses-alleged-zero-day-vulnerabilities-in-nuuo-nvrmini2-recording-device

Trust: 2.5

url:https://github.com/pedrib/poc/blob/master/advisories/nuuo/nuuo_nvrmini_round2.mkd

Trust: 2.5

url:https://github.com/rapid7/metasploit-framework/pull/16044

Trust: 2.5

url:https://news.ycombinator.com/item?id=29936569

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2022-23227

Trust: 1.4

url:https://cwe.mitre.org/data/definitions/306.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://github.com/alphabugx/cve-2022-23305

Trust: 0.1

sources: CNVD: CNVD-2022-70105 // VULMON: CVE-2022-23227 // JVNDB: JVNDB-2022-003358 // CNNVD: CNNVD-202201-1329 // NVD: CVE-2022-23227

SOURCES

db:CNVDid:CNVD-2022-70105
db:VULMONid:CVE-2022-23227
db:JVNDBid:JVNDB-2022-003358
db:CNNVDid:CNNVD-202201-1329
db:NVDid:CVE-2022-23227

LAST UPDATE DATE

2024-12-19T23:22:46.425000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2022-70105date:2022-10-20T00:00:00
db:VULMONid:CVE-2022-23227date:2022-01-21T00:00:00
db:JVNDBid:JVNDB-2022-003358date:2023-02-15T07:43:00
db:CNNVDid:CNNVD-202201-1329date:2022-01-24T00:00:00
db:NVDid:CVE-2022-23227date:2024-12-19T02:00:02.193

SOURCES RELEASE DATE

db:CNVDid:CNVD-2022-70105date:2022-10-21T00:00:00
db:VULMONid:CVE-2022-23227date:2022-01-14T00:00:00
db:JVNDBid:JVNDB-2022-003358date:2023-02-15T00:00:00
db:CNNVDid:CNNVD-202201-1329date:2022-01-14T00:00:00
db:NVDid:CVE-2022-23227date:2022-01-14T18:15:10.303