CVE-2022-23227 is a missing authentication vulnerability vulnerability in NUUO NVRmini2 Devices. CISA added it to the Known Exploited Vulnerabilities catalogue on 18 December 2024, which means attackers have used it in real attacks. NUUO NVRmini2 devices contain a missing authentication vulnerability that allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users.
What the missing authentication means in practice
A missing authentication flaw means the device accepts a sensitive action without first proving who the caller is. In network appliances, that often turns a web-facing management function into an open entry point, which is especially dangerous when the action can change configuration, create users, or plant persistent access.
For this CVE, the dangerous part is not just that an attacker can reach the device, but that the device will accept an upload flow without normal access checks. Once authentication is missing, the attacker no longer needs stolen credentials, and the security boundary around the management interface collapses.
Why this vulnerability is dangerous on an NVR appliance
NVR appliances sit close to physical-security operations, so compromise can affect surveillance visibility, retained footage, and administrative trust. If an attacker can upload content that the system later processes as administrative state, they may be able to add users or change access paths without ever logging in.
That makes the issue more than a standard web flaw. It can create durable footholds in a device that is often deployed continuously and monitored less frequently than a general-purpose server. A device exposed to the internet or reachable from a broad internal network becomes a high-value target because the attacker can convert a single unauthenticated request into long-lived access.
Vulnerability Management Guide is useful here because exposed appliances should be tracked, prioritised, and verified as remediated rather than treated as generic patch items.
How organisations check exposure and confirm impact
Exposure checking starts with asset inventory. Organisations need to know where NUUO NVRmini2 devices exist, whether they are internet reachable, and whether they are used in sensitive sites where camera integrity matters. Vendor advisories and the KEV catalogue are the authoritative places to confirm affected versions and patch status for this specific CVE.
After exposure is identified, the next question is whether the device has already been touched. Because the flaw can be abused to add arbitrary users, administrators should review local accounts, recent configuration changes, and any unexpected administrative access. If logs are limited, absence of evidence is not evidence of absence, so a compromise review should be conservative.
NIST National Vulnerability Database and the CVE Program are the best starting points for canonical record lookup, while the vendor advisory remains the source for exact remediation details.
Containment and recovery when patching is delayed
If the device cannot be patched immediately, the practical goal is to reduce reachable attack surface and prevent unauthenticated management access. That usually means isolating the appliance, restricting network paths to the management interface, and placing it behind trusted administrative access controls until the vendor fix can be applied.
Because the likely abuse path involves user creation or other configuration manipulation, recovery should assume the device may already contain unauthorized administrative state. Reset or remove unexpected accounts, review local configuration for tampering, and rotate any credentials or secrets that were stored or managed through the appliance if compromise is suspected. If the appliance participates in broader surveillance or export workflows, those downstream trust relationships should also be reviewed.
Risk and Threat Considerations
Unauthenticated management flaws on internet-reachable appliances are attractive because they can be exploited quickly and quietly. In this case, the attacker does not need valid credentials, which lowers the cost of exploitation and increases the chance of opportunistic abuse across exposed devices.
Failure mechanism: The attacker sends a crafted upload request that the appliance accepts without authentication, then uses the resulting state change to create users or establish administrative control.
Impact: The device can be turned into a persistent access point, surveillance trust can be undermined, and administrators may lose confidence in the integrity of recorded evidence and operational monitoring.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.AM-01 — Asset Management | Exposure assessment depends on knowing where the NVR appliances are deployed. |
| PR.AA-01 — Identity Management, Authentication and Access Control | The flaw is fundamentally an authentication and access-control failure on a management function. | |
| DE.CM-09 — Network Monitoring | Unauthorised access and unusual upload activity should be detectable through monitoring. | |
| Recommendation — Maintain an accurate inventory of NVR appliances and their network exposure. Enforce authenticated administrative access to appliance management functions. Monitor appliance management traffic for unauthorised access and anomalous uploads. | ||
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Administrative access should require authenticated users before any privileged action. |
| AU-2 — Event Logging | Post-compromise review depends on logs for uploads, account changes and admin activity. | |
| Recommendation — Require strong authentication before allowing administrative actions on the appliance. Log administrative events, uploads, and account changes for later compromise review. | ||
| CIS Controls v8 | CIS-5 — Account Management | The abuse path can add arbitrary users, so account governance is central to response. |
| Recommendation — Review, remove, and tightly govern local appliance accounts and privileges. | ||
Practitioner Guidance
What to watch for: Treat unexpected local users, unusual configuration changes, and uploads to management functions as compromise signals, not just misconfiguration. For appliances in security-sensitive environments, review them as you would a control plane, because administrative tampering can have outsized operational consequences.
Practitioner takeaway: For exposed appliances, exposure management and compromise review matter as much as patching, because missing authentication can leave behind access even after the vulnerable interface is fixed.
Related resources from NHI Mgmt Group
- Why do connected medical devices create such high risk when authentication is weak or missing?
- CVE-2022-22265 (Samsung Mobile Devices Use-After-Free)
- CVE-2025-32433 (Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function)
- CVE-2023-28461 (Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function)