Historical catalog analysis: CISA added this entry on December 18, 2024. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.
What the vulnerability is
CVE-2022-23227 is a missing authentication vulnerability (CWE-306) affecting NUUO NVRmini2 devices. The flaw allows an unauthenticated attacker to upload an encrypted TAR archive to the device, which can be leveraged to add arbitrary users to the system.
Exposure and applicability
This vulnerability applies specifically to NUUO NVRmini2 devices. In industrial environments, Network Video Recorders (NVRs) are frequently deployed as part of the physical security layer to monitor plant perimeters, critical infrastructure assets, and operational areas. If these devices are accessible via the network without compensating controls, they may be susceptible to unauthorized user creation.
Remediation priorities
Because the NUUO NVRmini2 is designated as end-of-life (EoL) and/or end-of-service (EoS), there is no official patch available to resolve this vulnerability. Based on our analysis, asset owners should prioritize the following actions:
- Inventory and Identification: Identify all deployed NVRmini2 units within the OT environment. This is a prerequisite for any risk mitigation strategy.
- Decommissioning: Following CISA’s recommendation, the primary remediation is to discontinue utilization of the product and replace it with supported hardware.
- Network Isolation: For units that cannot be immediately replaced due to operational constraints, we suggest isolating these devices on a dedicated VLAN with strict access control lists (ACLs) to prevent unauthenticated network access from other segments of the industrial network.
How to validate remediation
Validation depends on the chosen path. If the device is decommissioned, verification consists of confirming the hardware has been removed from the network and powered down. If isolation is used as a temporary measure, validation should involve verifying that the NVR’s management interface is unreachable from unauthorized network segments via authorized network mapping or firewall rule audits.
Limits and open questions
It remains unknown whether this vulnerability has been utilized in ransomware campaigns. Furthermore, because the product is EoL, there is no vendor-supplied firmware update to address the root cause. Users should be aware that network isolation only reduces the likelihood of initial access; it does not resolve the underlying authentication flaw. Residual risk remains for any user or system with authorized access to the isolated segment.
Source and editorial note
CVE-2022-23227: NUUO NVRmini2 Devices Missing Authentication Vulnerability · Source date: December 18, 2024 · Retrieved August 31, 2026.
Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.
Archive date: December 21, 2024. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 23, 2026 at 01:24 UTC.
Request an OT security assessment
Protect the systems your operations depend on.
Discuss your industrial environment, prioritize exposure, and establish evidence that safeguards work.
Request an OT assessment ↗