Historical catalog analysis: CISA added this entry on December 18, 2024. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.
What the vulnerability is
CVE-2022-23227 is a missing authentication vulnerability (CWE-306) affecting NUUO NVRmini2 devices. The flaw allows an unauthenticated attacker to upload an encrypted TAR archive to the device. This mechanism can be abused to add arbitrary users to the system, potentially granting unauthorized administrative access.
Exposure and applicability
This vulnerability applies specifically to organizations utilizing NUUO NVRmini2 hardware. The attack vector is network-based, as it involves the upload of a malicious archive to the device without requiring prior credentials. Infrastructure owners should identify all deployed NVRmini2 units within their environment to determine the scope of exposure.
Remediation priorities
Based on the available data, there is no patch for this vulnerability because the affected product has reached end-of-life (EoL) and/or end-of-service (EoS) status. Our analysis suggests the following priority actions:
- Immediate Decommissioning: The primary remediation is to discontinue the use of NVRmini2 devices. Since the vendor no longer supports the product, it cannot be secured against this flaw via software updates.
- Network Isolation: For assets that cannot be removed instantly, defenders should isolate these devices from all untrusted networks and restrict access to a highly controlled management VLAN to reduce the likelihood of an unauthenticated upload.
- Asset Replacement: Prioritize the migration of surveillance functions to supported hardware that receives active security updates.
How to validate remediation
Verification in this case is not a matter of checking a software version, as no patched version exists. Remediation is verified through evidence of removal or total isolation:
* Physical/Logical Inventory: Confirm the decommissioning of all NVRmini2 serial numbers from the network inventory.
* Network Traffic Validation: If the device remains temporarily for data retrieval, verify via firewall logs that no external or unauthorized internal traffic can reach the device’s management interface.
Limits and open questions
Because the product is EoL/EoS, there are significant limitations to risk reduction. Even with network isolation, residual risk remains if an attacker gains a foothold within the trusted management segment. It remains unknown whether this vulnerability has been utilized in ransomware campaigns. Furthermore, because no patch was issued, defenders cannot rely on traditional vulnerability scanning to ‘clear’ these devices; only total removal or strict access control provides a measurable reduction in exposure.
Source and editorial note
CVE-2022-23227: NUUO NVRmini2 Devices Missing Authentication Vulnerability · Source date: December 18, 2024 · Retrieved August 31, 2026.
Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.
Archive date: December 21, 2024. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 31, 2026 at 00:15 UTC.
Request a Vulnerability Assessment
Turn security intelligence into action.
Discuss your exposure, priorities, and the evidence needed to validate the outcome.
Request a security assessment ↗