PT-2024-13731 · Newland · Newland Nquire 1000 Interactive Kiosk

N0Obit4 · Published 2024-03-08 · Updated 2024-08-01 · CVE-2023-49340

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Newland Nquire 1000 Interactive Kiosk version NQ1000-II G V1.00.011

Description An issue was discovered in the Newland Nquire 1000 Interactive Kiosk, allowing remote attackers to escalate privileges and bypass authentication via incorrect access control in the web management portal.

Recommendations For version NQ1000-II G V1.00.011, consider restricting access to the web management portal until a patch is available. As a temporary workaround, review and adjust the access control settings in the web management portal to minimize the risk of exploitation. Avoid using the web management portal for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

CWE-1390

Related Identifiers

CVE-2023-49340

Affected Products

Newland Nquire 1000 Interactive Kiosk

References · 6

• 🔥 https://github.com/n0obit4/Vulnerability_Disclosure/tree/main/CVE-2023-49340 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-49340 · Security Note
• https://twitter.com/CVEnew/status/1766332121973407831 · Twitter Post
• https://t.me/cvenotify/73461 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1766353752741523765 · Twitter Post
• https://t.me/cvenotify/73418 · Telegram Post