PT-2023-4506 · Netmodule · Netmodule Nsrw

Q. Kaiser + 1 · Published 2023-02-16 · Updated 2024-09-12 · CVE-2023-0861

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions NetModule NSRW versions 4.3.0.0 through 4.3.0.118 NetModule NSRW versions 4.4.0.0 through 4.4.0.117 NetModule NSRW versions 4.6.0.0 through 4.6.0.104 NetModule NSRW versions 4.7.0.0 through 4.7.0.102

Description The NetModule NSRW web administration interface executes an OS command constructed with unsanitized user input. A successful exploit could allow an authenticated user to execute arbitrary commands with elevated privileges.

Recommendations For versions 4.3.0.0 through 4.3.0.118, update to version 4.3.0.119 or later. For versions 4.4.0.0 through 4.4.0.117, update to version 4.4.0.118 or later. For versions 4.6.0.0 through 4.6.0.104, update to version 4.6.0.105 or later. For versions 4.7.0.0 through 4.7.0.102, update to version 4.7.0.103 or later.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

BDU:2023-04909

CVE-2023-0861

Affected Products

Netmodule Nsrw

References · 12

• 🔥 https://github.com/seifallahhomrani1/CVE-2023-0861-POC · Exploit
• https://osv.dev/vulnerability/CVE-2023-0861 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0861 · Security Note
• https://bdu.fstec.ru/vul/2023-04909 · Security Note
• https://t.me/cibsecurity/72746 · Telegram Post
• https://t.me/cybersecuritytechnologies/7956 · Telegram Post
• https://share.netmodule.com/public/system-software/4.7/4.7.0.103/NRSW-RN-4.7.0.103.pdf · Note
• https://t.me/cvenotify/59920 · Telegram Post
• https://t.me/cvenotify/44451 · Telegram Post
• https://onekey.com/blog/security-advisory-netmodule-multiple-vulnerabilities · Note
• https://t.me/cibsecurity/58306 · Telegram Post
• https://t.me/cvenotify/94425 · Telegram Post