PT-2023-29558 · Netis · Netis N3Mv2

Published 2023-10-13 · Updated 2023-10-19 · CVE-2023-45467

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Netis N3Mv2 version 1.0.1.865

Description A command injection issue was discovered via the ntpServIP parameter in the Time Settings. This allows for potential exploitation.

Recommendations For Netis N3Mv2 version 1.0.1.865, consider restricting access to the Time Settings until a patch is available. As a temporary workaround, avoid using the ntpServIP parameter in the Time Settings to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2023-45467

Affected Products

Netis N3Mv2

References · 5

• 🔥 https://github.com/adhikara13/CVE/blob/main/netis_N3/blind%20command%20injection%20in%20ntpServIP%20parameter%20in%20Time%20Settings%20.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-45467 · Security Note
• https://osv.dev/vulnerability/CVE-2023-45467 · Vendor Advisory
• https://t.me/cibsecurity/72240 · Telegram Post
• https://t.me/cvenotify/59426 · Telegram Post