PT-2023-16568 · Netmodule · Netmodule Nsrw

Quentin Kaiser · Published 2023-02-16 · Updated 2024-09-12 · CVE-2023-0862

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NetModule NSRW versions 4.3.0.0 through 4.3.0.118 NetModule NSRW versions 4.4.0.0 through 4.4.0.117 NetModule NSRW versions 4.6.0.0 through 4.6.0.104 NetModule NSRW versions 4.7.0.0 through 4.7.0.102

Description The NetModule NSRW web administration interface is susceptible to path traversal attacks. This could allow authenticated users to upload arbitrary files to the web root directory, potentially leading to remote command execution with elevated privileges.

Recommendations For versions 4.3.0.0 through 4.3.0.118, update to version 4.3.0.119 or later. For versions 4.4.0.0 through 4.4.0.117, update to version 4.4.0.118 or later. For versions 4.6.0.0 through 4.6.0.104, update to version 4.6.0.105 or later. For versions 4.7.0.0 through 4.7.0.102, update to version 4.7.0.103 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-0862

Affected Products

Netmodule Nsrw

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2023-0862 · Security Note
• https://osv.dev/vulnerability/CVE-2023-0862 · Vendor Advisory
• https://share.netmodule.com/public/system-software/4.7/4.7.0.103/NRSW-RN-4.7.0.103.pdf · Vendor Advisory
• https://onekey.com/blog/security-advisory-netmodule-multiple-vulnerabilities · Note
• https://t.me/cibsecurity/72746 · Telegram Post
• https://t.me/cibsecurity/58308 · Telegram Post
• https://t.me/cvenotify/59920 · Telegram Post
• https://t.me/cvenotify/44452 · Telegram Post
• https://t.me/cvenotify/94425 · Telegram Post