CVE-2023-0862 Path Traversal in NetModule NSRW
Authenticated attackers can exploit path traversal to upload malicious files, leading to remote code execution with elevated privileges on NetModule NSRW devices.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-0862?
CVE-2023-0862 is a high-severity path traversal vulnerability in NetModule NSRW, published on 16 Feb 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The NetModule NSRW web administration interface is vulnerable to path traversals, which could lead to arbitrary file uploads and deletion. By uploading malicious files to the web root directory, authenticated users could gain remote command execution with elevated privileges.
This issue affects NSRW: from 4.3.0.0 before 4.3.0.119, from 4.4.0.0 before 4.4.0.118, from 4.6.0.0 before 4.6.0.105, from 4.7.0.0 before 4.7.0.103.
Weakness: CWE-22
Which versions are affected by CVE-2023-0862?
It affects 1 product.
Products include Netmodule Netmodule Router Software.
How do I fix CVE-2023-0862?
No fix has been published for CVE-2023-0862 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-0862 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-0862 exists.
Other vulnerabilities in NetModule NSRW
Sources
Also known as GHSA-hp6q-h54g-hcww.