PT-2023-29948 · Netmodule · Netmodule Router

Nuri Çilengir · Published 2023-10-22 · Updated 2024-09-12 · CVE-2023-46306

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NetModule Router Software versions 4.6 through 4.6.0.105 NetModule Router Software versions 4.8 through 4.8.0.100

Description The web administration interface in NetModule Router Software executes an OS command, potentially leading to remote code execution.

Recommendations For NetModule Router Software versions 4.6 through 4.6.0.105, update to version 4.6.0.106 or later. For NetModule Router Software versions 4.8 through 4.8.0.100, update to version 4.8.0.101 or later.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2023-46306

Affected Products

Netmodule Router

References · 9

• https://osv.dev/vulnerability/CVE-2023-46306 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46306 · Security Note
• https://t.me/cvenotify/59920 · Telegram Post
• https://share.netmodule.com/public/system-software/4.6/4.6.0.106/NRSW-RN-4.6.0.106.pdf · Note
• https://pentest.blog/advisory-netmodule-router-software-race-condition-leads-to-remote-code-execution · Note
• https://t.me/cibsecurity/72746 · Telegram Post
• https://t.me/cvenotify/94425 · Telegram Post
• https://t.me/latest_high_impact_cve/42 · Telegram Post
• https://share.netmodule.com/public/system-software/4.8/4.8.0.101/NRSW-RN-4.8.0.101.pdf · Note