PT-2024-13732 · Newland · Newland Nquire 1000 Interactive Kiosk

N0Obit4 · Published 2024-03-08 · Updated 2024-08-26 · CVE-2023-49341

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Newland Nquire 1000 Interactive Kiosk version NQ1000-II G V1.00.011

Description An issue was discovered in the Newland Nquire 1000 Interactive Kiosk, allowing remote attackers to obtain sensitive information via cleartext credential storage in the backup.htm component.

Recommendations For version NQ1000-II G V1.00.011, consider restricting access to the backup.htm component to minimize the risk of exploitation. As a temporary workaround, avoid using the backup.htm component until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2023-49341

Affected Products

Newland Nquire 1000 Interactive Kiosk

References · 6

• 🔥 https://github.com/n0obit4/Vulnerability_Disclosure/tree/main/CVE-2023-49341 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-49341 · Security Note
• https://twitter.com/CVEnew/status/1766322953661153600 · Twitter Post
• https://t.me/cvenotify/73462 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1766353246317125639 · Twitter Post
• https://t.me/cvenotify/73419 · Telegram Post