CVE-2023-0862
CVSS V2 None
CVSS V3 None
Description
The NetModule NSRW web administration interface is vulnerable to path traversals, which could lead to arbitrary file uploads and deletion. By uploading malicious files to the web root directory, authenticated users could gain remote command execution with elevated privileges. This issue affects NSRW: from 4.3.0.0 before 4.3.0.119, from 4.4.0.0 before 4.4.0.118, from 4.6.0.0 before 4.6.0.105, from 4.7.0.0 before 4.7.0.103.
Overview
- CVE ID
- CVE-2023-0862
- Assigner
- research@onekey.com
- Vulnerability Status
- Analyzed
- Published Version
- 2023-02-16T10:15:11
- Last Modified Date
- 2023-02-24T18:13:08
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:a:netmodule:netmodule_router_software:*:*:*:*:*:*:*:* | 1 | OR | 4.3.0.0 | 4.3.0.119 |
| cpe:2.3:a:netmodule:netmodule_router_software:*:*:*:*:*:*:*:* | 1 | OR | 4.4.0.0 | 4.4.0.118 |
| cpe:2.3:a:netmodule:netmodule_router_software:*:*:*:*:*:*:*:* | 1 | OR | 4.6.0.0 | 4.6.0.105 |
| cpe:2.3:a:netmodule:netmodule_router_software:*:*:*:*:*:*:*:* | 1 | OR | 4.7.0.0 | 4.7.0.103 |
References
| Reference URL | Reference Tags |
|---|---|
| https://onekey.com/blog/security-advisory-netmodule-multiple-vulnerabilities/ | Third Party Advisory |
| https://share.netmodule.com/public/system-software/4.7/4.7.0.103/NRSW-RN-4.7.0.103.pdf | Release Notes Vendor Advisory |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2023-0862 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0862 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2023-04-17 07:49:50 | Added to TrackCVE | |||
| 2023-04-17 07:49:51 | Weakness Enumeration | new |