CVE-2023-0862
Last modified
CVE-2023-0862 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. The NetModule NSRW web administration interface is vulnerable to path traversals, which could lead to arbitrary file uploads and deletion. By uploading malicious files to the web root directory, authenticated users could gain remote command execution with elevated privileges. This issue affects NSRW: from 4.3.0.0 before 4.3.0.119, from 4.4.0.0 before 4.4.0.118, from 4.6.0.0 before 4.6.0.105, from 4.7.0.0 before 4.7.0.103. . EPSS estimates a 2.35% chance of exploitation in the next 30 days.
Description
The NetModule NSRW web administration interface is vulnerable to path traversals, which could lead to arbitrary file uploads and deletion. By uploading malicious files to the web root directory, authenticated users could gain remote command execution with elevated privileges. This issue affects NSRW: from 4.3.0.0 before 4.3.0.119, from 4.4.0.0 before 4.4.0.118, from 4.6.0.0 before 4.6.0.105, from 4.7.0.0 before 4.7.0.103.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Netmodule | Netmodule Router Software | >= 4.3.0.0, < 4.3.0.119 |
| Netmodule | Netmodule Router Software | >= 4.4.0.0, < 4.4.0.118 |
| Netmodule | Netmodule Router Software | >= 4.6.0.0, < 4.6.0.105 |
| Netmodule | Netmodule Router Software | >= 4.7.0.0, < 4.7.0.103 |
References
- https://onekey.com/blog/security-advisory-netmodule-multiple-vulnerabilities/Third Party Advisory
- https://share.netmodule.com/public/system-software/4.7/4.7.0.103/NRSW-RN-4.7.0.103.pdfRelease Notes, Vendor Advisory
- https://onekey.com/blog/security-advisory-netmodule-multiple-vulnerabilities/Third Party Advisory
- https://share.netmodule.com/public/system-software/4.7/4.7.0.103/NRSW-RN-4.7.0.103.pdfRelease Notes, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-0862?
How severe is CVE-2023-0862?
How do I fix CVE-2023-0862?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-0856Buffer overflow in IPP sides attribute process of Office / S…9.8
- CVE-2023-0857Unintentional change of settings during initial registration…7.5
- CVE-2023-0858Improper Authentication of RemoteUI of Office / Small Office…5.3
- CVE-2023-0859Arbitrary Files can be installed in the Setting Data Import …5.3
- CVE-2023-0860Improper Restriction of Excessive Authentication Attempts in…7.5
- CVE-2023-0861NetModule NSRW web administration interface executes an OS c…8.8
- CVE-2023-0863Improper Authentication vulnerability in ABB Terra AC wallbo…8.8
- CVE-2023-0864Cleartext Transmission of Sensitive Information vulnerabilit…4.3
- CVE-2023-0865The WooCommerce Multiple Customer Addresses & Shipping WordP…8.8
- CVE-2023-0866Heap-based Buffer Overflow in GitHub repository gpac/gpac pr…7.8
- CVE-2023-0867Multiple stored and reflected cross-site scripting vulnerabi…6.1
- CVE-2023-0868Reflected cross-site scripting in graph results in multiple …6.1
Are you affected by CVE-2023-0862?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST