NUUO NVRmini2 <= 3.11.x Unrestricted Upload RCE

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(243239);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/07/31");

  script_cve_id("CVE-2022-23227");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2025/01/08");

  script_name(english:"NUUO NVRmini2 <= 3.11.x Unrestricted Upload RCE");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by a remote code execution vulnerability.");
  script_set_attribute(attribute:"description", value:
"NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused
to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw
(CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://github.com/advisories/GHSA-5f63-p3w5-jphc");
  script_set_attribute(attribute:"solution", value:
"NUUO NVRMini2 is EOL. Contact vendor or replace device.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-23227");

  script_set_attribute(attribute:"vuln_publication_date", value:"2022/01/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/07/31");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:nuuo:nvrmini2_firmware");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nuuo_netgear_www_video_detect.nbin");
  script_require_keys("installed_sw/NUUO NVR");
  script_require_ports("Services/www", 80);

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'NUUO NVR', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'fixed_version': '3.12', 'fixed_display': 'Check with vendor'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);