NUUO NVRmini2 Devices Missing Authentication Vulnerability
NUUO NVRmini2 devices contain a missing authentication vulnerability that allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users.
- Vendor
- NUUO
- Product
- NVRmini2 Devices
- CVSS
- 9.8
- EPSS (exploit probability)
- 49.4%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
NUUO NVRmini2 devices contain a missing authentication vulnerability that allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users.
Added to CISA’s Known Exploited Vulnerabilities catalog on 2024-12-18. Required action per CISA: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product. Due date: 2025-01-08.
This is an auto-synced KEV catalog record pending a full 0dayNews write-up — see CISA’s KEV catalog and the NVD record linked above for primary sources.