CVE-2022-23227

What it actually does

The flaw is a missing-authentication vulnerability in NUUO NVRmini2 firmware through version 3.11. An unauthenticated network attacker can reach handle_import_user.php and upload an encrypted TAR archive intended for user import operations. Because the endpoint does not require a valid session, the attacker can abuse the import workflow to add arbitrary users. When chained with CVE-2011-5325, the archive handling can be used to overwrite files under the web root, enabling placement of executable web content and remote code execution with root-level privileges. The result is full compromise of the NVR appliance, including confidentiality, integrity, and availability impact.

Why it matters to the business

Successful exploitation can give an attacker administrative control over video surveillance infrastructure, allowing them to view or delete footage, create backdoor accounts, disrupt recording, pivot into adjacent networks, and deploy persistent malware. Because this vulnerability is listed in CISA KEV with active in-the-wild exploitation and a remediation due date of 2025-01-08, exposed devices should be treated as high-priority risks even though the vulnerability is older. Internet-facing or third-party-accessible NVRmini2 systems are especially concerning because exploitation requires no credentials or user interaction.

How an attack unfolds

An attacker first identifies a reachable NUUO NVRmini2 web interface. They then send a crafted unauthenticated request to the user-import handler, handle_import_user.php, with an encrypted TAR archive formatted to be accepted by the device. In the basic abuse case, the import operation creates attacker-controlled user accounts without requiring prior authentication. In a chained attack, the archive is crafted to exploit the related file overwrite weakness, causing files to be written beneath the web root. The attacker can then request the newly written web-accessible file to execute commands on the appliance, potentially as root. After gaining execution, the attacker may add persistent accounts, install web shells or other payloads, tamper with recordings, disable services, or use the device as a foothold into the broader network.

How to fix it

Upgrade affected NUUO NVRmini2 firmware to a vendor-supported release that removes unauthenticated access to the user import handler and addresses the associated archive/file overwrite behavior. No exact fixed version was provided in the input, so administrators should verify the currently supported firmware directly with NUUO and avoid relying on firmware versions through 3.11. If no supported fixed firmware is available, retire or replace the appliance. Until remediation is complete, remove NVRmini2 management interfaces from the public internet, restrict access to trusted administrative networks or VPNs, block direct access to handle_import_user.php at a reverse proxy or firewall where possible, disable unnecessary remote management, rotate all device credentials, and review/remove unknown user accounts. For any device suspected of compromise, perform full incident response and rebuild/reimage from trusted firmware rather than only changing passwords.

How to confirm the fix worked

Confirm the device firmware version is not an affected release and that vendor documentation indicates the missing-authentication import issue is fixed. From an unauthenticated network location, attempt to access or POST to handle_import_user.php and verify the request is rejected with an authentication requirement rather than processed. Review the device user list and confirm no unexpected accounts exist. Inspect the web root for recently modified or suspicious PHP files. Validate that administrative access is restricted to approved networks and that the management interface is not internet-exposed. If a compensating control is used, test that firewall, proxy, or WAF policy blocks unauthenticated requests to the vulnerable endpoint.

Typical attack path

1. Scan for exposed NUUO NVRmini2 web management interfaces.
2. Confirm the device exposes the vulnerable user import endpoint, especially handle_import_user.php.
3. Submit an unauthenticated crafted encrypted TAR archive to the import endpoint.
4. Create unauthorized user accounts through the unauthenticated import workflow.
5. Optionally chain with the arbitrary file overwrite issue to place executable content under the web root.
6. Access the planted web-accessible file or web shell to execute commands on the appliance.
7. Establish persistence by adding accounts, modifying startup files, or leaving additional web shells.
8. Use the compromised NVR to access surveillance data, disrupt recording, or pivot to internal systems.

How to detect it

Review web server and application logs for unauthenticated requests to handle_import_user.php, especially POST requests with archive or multipart upload characteristics. Look for user-import activity from unfamiliar source IP addresses, followed by new account creation or administrative logins. Inspect the web root and application directories for recently created or modified PHP files, unexpected TAR extraction artifacts, or files with names that do not match the vendor firmware image. On devices with shell or forensic access, review process execution for web server-spawned shells, command interpreters, download utilities, or persistence mechanisms running as root. Correlate suspicious endpoint access with subsequent logins, camera configuration changes, recording deletion, device reboot, service disablement, outbound connections, port scans, or authentication attempts against other systems. Since active exploitation is known, include historical log review for the period before patching or isolation, not only current detections.

• handle_import_user.php
• POST /handle_import_user.php
• /handle_import_user.php
• multipart/form-data
• Content-Disposition: form-data
• filename="*.tar"
• filename="*.tar.gz"
• filename="*.tgz"
• /var/www/*.php
• /var/www/html/*.php
• /www/*.php
• /tmp/*.tar
• /tmp/*.tgz
• /tmp/*.tar.gz
• /bin/sh -c
• /bin/bash -c
• wget http
• curl http
• chmod +x

What your security team should do

• Immediately identify all NUUO NVRmini2 devices, including appliances managed by facilities, physical security, or third parties.
• Prioritize any internet-facing NVRmini2 system for emergency isolation or shutdown until remediated.
• Upgrade to vendor-supported fixed firmware where available; if no fixed firmware is available, plan replacement or retirement.
• Block unauthenticated access to handle_import_user.php and restrict management access to VPN or dedicated administrative networks only.
• Because this issue is in CISA KEV and has active in-the-wild exploitation, perform compromise assessment on exposed devices rather than assuming patching alone is sufficient.
• Audit local device users and remove unknown or unauthorized accounts.
• Search for web shells, unexpected PHP files, modified web content, and abnormal root-owned processes on affected appliances.
• Rotate credentials associated with the NVR and any reused passwords after the device is remediated or rebuilt.
• Monitor network traffic from NVRs for unusual outbound connections, lateral movement, or scanning behavior.
• If evidence of exploitation is found, preserve logs and firmware/filesystem artifacts, rebuild the device from trusted media, and review adjacent network systems for follow-on activity.