CVE-2022-23227
Description
NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root.
Summary dbcve.org
NUUO NVRmini2 (through version 3.11) exposes handle_import_user.php without authentication, allowing an unauthenticated remote attacker to upload an encrypted TAR archive that the endpoint will unpack and use to add arbitrary user accounts. Because the user-import flow also permits placing files under the web root, an attacker can chain this with CVE-2011-5325 (path/traversal or arbitrary file write in the same product) to overwrite web-root files and achieve unauthenticated remote code execution as root.
Mitigation
Upgrade NUUO NVRmini2 firmware to a version that enforces authentication on handle_import_user.php and validates/sanitizes uploaded TAR archive contents; until a vendor patch is available, restrict network access to the NVR's web management interface and disable the user-import functionality at the network layer.