Yes. CISA added CVE-2022-23227 to its Known Exploited Vulnerabilities catalogue on 18 December 2024, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. NUUO NVRmini2 devices contain a missing authentication vulnerability that allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users.
Why active exploitation changes the response for CVE-2022-23227
For a missing authentication flaw that lets an unauthenticated attacker upload a crafted archive and add users, the key question is not just whether the bug exists, but whether exploitation has crossed from theory into live abuse. Once CISA places a CVE in KEV, defenders should treat exposure as urgent, because attackers can often turn a simple initial access issue into persistent administrative access.
That is why the practical response starts with scope: identify every NUUO NVRmini2 device, confirm whether internet exposure exists, and determine whether the device is still reachable from user or management networks. If the product is exposed, the risk is not limited to the vulnerable endpoint itself, because added accounts can become a foothold for further surveillance, tampering, or pivoting.
For current exploit-likelihood triage, use the Zero-Day and Exploited Vulnerabilities Guide to prioritize KEV-listed issues, emergency mitigation, and post-patch hunting. The same prioritisation logic appears in the Vulnerability Management Guide, which is useful when you need to turn an exploitation signal into a remediation queue and verification plan.
What to do if patching must wait
When a device cannot be patched immediately, the safest assumption is that the attack path may already be available to anyone with network reach. Restrict access to the management interface, remove direct internet exposure, and place the device behind the narrowest feasible administrative path. If remote administration must remain enabled, segment it so only explicitly approved operators and jump hosts can reach it.
Because the flaw is an authentication failure, compensating controls should focus on reducing reachability and limiting the blast radius of any newly created account. Review whether the device can be isolated without breaking operations, then document the exception window, owner, and rollback condition. If a compensating control depends on ordinary network filtering alone, treat it as temporary rather than sufficient.
CISA Known Exploited Vulnerabilities Catalog should be the authoritative source for the required action and remediation timing, while the vendor advisory should provide the exact fix path for your device build. If your environment cannot remediate immediately, pair the KEV entry with the vendor instructions and a tight exposure-reduction plan rather than waiting for a routine maintenance window.
How to verify compromise after the exposure window
For a flaw that can create arbitrary users, compromise checks should look beyond the vulnerability banner and focus on changes to local accounts, administrative membership, configuration drift, and unexpected archive uploads. Search for newly created or modified users, unexplained privilege changes, and any login activity that does not match known maintenance windows or operator accounts.
If the device stores logs or telemetry locally, preserve them before remediation so you can reconstruct whether the attacker only added users or also altered device settings, retained access, or used the appliance as a stepping stone. If the appliance has weak logging, that limitation itself is useful evidence, because it means you may need to rely on network records, access logs, or upstream monitoring to bound the incident.
The NIST National Vulnerability Database and the CVE Program are the cleanest places to confirm the record details, but compromise assessment must be driven by your own environment evidence. Treat the presence of a KEV-listed issue as a trigger to hunt, not as proof of compromise by itself.
Risk and Threat Considerations
This vulnerability is dangerous because it removes the normal authentication barrier in front of an administrative surface. When an attacker can upload a crafted archive and create users without valid credentials, the device becomes susceptible to rapid foothold creation, persistence, and unauthorized configuration changes.
Failure mechanism: The attacker exploits missing authentication to reach a function that should be restricted, then uses that function to add an account or otherwise expand access. If the device is reachable from untrusted networks, exploitation can happen without any prior compromise of another account.
Impact: Successful abuse can expose video systems, operational data, and management trust, while also creating a durable entry point that may survive simple password changes. In environments that depend on the recorder for physical security or incident review, the operational impact can extend well beyond IT containment.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | KEV-listed exploitation requires prioritized vulnerability handling. |
| Recommendation — Prioritize, track, and remediate the exposed device before routine maintenance. | ||
| NIST CSF 2.0 | ID.RA-01 — Asset Vulnerabilities Are Identified and Recorded | The question turns on identifying an exposed, actively exploited vulnerability. |
| RS.MA-01 — Mitigation is Performed | Active exploitation calls for containment and mitigation, not just awareness. | |
| Recommendation — Identify all affected devices and record the exposure status immediately. Contain exposed systems and apply the vendor fix or mitigation quickly. | ||
| NIST SP 800-53 Rev 5 | RA-5 — Vulnerability Monitoring and Scanning | This requires monitoring for known exploited vulnerabilities and validating exposure. |
| Recommendation — Continuously monitor for KEV-listed flaws and verify whether the device is exposed. | ||
| ISO/IEC 27001:2022 | A.8.8 — Management of technical vulnerabilities | The issue is a technical vulnerability requiring governed prioritisation and remediation. |
| Recommendation — Track, assess, and remediate the vulnerable device under a formal process. | ||
Practitioner Guidance
What to verify: Confirm whether any NVRmini2 instance is internet-facing, whether local admin accounts were changed unexpectedly, and whether archive upload activity aligns with authorised maintenance. If you cannot prove the device was never exposed, assume it deserves incident review before routine patch scheduling.
Decision rule: If the device is live and reachable, isolate first, patch second, and investigate third if you need to preserve evidence. If the device is already isolated and logs show no suspicious account changes, remediation can proceed with a narrower hunt, but only after you retain enough evidence to explain the exposure window.
Practitioner takeaway: For KEV-listed authentication bypasses, the right question is not “has exploitation been proven in my tenant,” but “how fast can an attacker turn this appliance into a trusted foothold, and what evidence do I still need before I remove it from service?”
Related resources from NHI Mgmt Group
- CVE-2022-23227 (NUUO NVRmini2 Devices Missing Authentication Vulnerability)
- Is CVE-2022-22265 (Samsung Mobile Devices Use-After-Free) being exploited in the wild?
- Is CVE-2025-32433 (Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function) being exploited in the wild?
- Is CVE-2024-5910 (Palo Alto Networks Expedition Missing Authentication) being exploited in the wild?