CVE-2023-0861

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-0861
NetModule NSRW web administration interface executes an OS command constructed with unsanitized user input. A successful exploit could allow an authenticated user to execute arbitrary commands with elevated privileges. This issue affects NSRW: from 4.3.0.0 before 4.3.0.119, from 4.4.0.0 before 4.4.0.118, from 4.6.0.0 before 4.6.0.105, from 4.7.0.0 before 4.7.0.103.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://onekey.com/blog/security-advisory-netmodule-multiple-vulnerabilities Third Party Advisory
https://share.netmodule.com/public/system-software/4.7/4.7.0.103/NRSW-RN-4.7.0.103.pdf Release Notes
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:a:netmodule:netmodule_router_software:*:*:*:*:*:*:*:*
cpe:2.3:a:netmodule:netmodule_router_software:*:*:*:*:*:*:*:*
cpe:2.3:a:netmodule:netmodule_router_software:*:*:*:*:*:*:*:*
cpe:2.3:a:netmodule:netmodule_router_software:*:*:*:*:*:*:*:*
OR cpe:2.3:h:netmodule:nb1601:-:*:*:*:*:*:*:*
cpe:2.3:h:netmodule:nb1800:-:*:*:*:*:*:*:*
cpe:2.3:h:netmodule:nb1810:-:*:*:*:*:*:*:*
cpe:2.3:h:netmodule:nb2800:-:*:*:*:*:*:*:*
cpe:2.3:h:netmodule:nb2810:-:*:*:*:*:*:*:*
cpe:2.3:h:netmodule:nb3701:-:*:*:*:*:*:*:*
cpe:2.3:h:netmodule:nb3800:-:*:*:*:*:*:*:*
cpe:2.3:h:netmodule:nb800:-:*:*:*:*:*:*:*
cpe:2.3:h:netmodule:ng800:-:*:*:*:*:*:*:*
History

07 Nov 2023, 04:01

Type Values Removed Values Added
Summary NetModule NSRW web administration interface executes an OS command constructed with unsanitized user input. A successful exploit could allow an authenticated user to execute arbitrary commands with elevated privileges. This issue affects NSRW: from 4.3.0.0 before 4.3.0.119, from 4.4.0.0 before 4.4.0.118, from 4.6.0.0 before 4.6.0.105, from 4.7.0.0 before 4.7.0.103. NetModule NSRW web administration interface executes an OS command constructed with unsanitized user input. A successful exploit could allow an authenticated user to execute arbitrary commands with elevated privileges. This issue affects NSRW: from 4.3.0.0 before 4.3.0.119, from 4.4.0.0 before 4.4.0.118, from 4.6.0.0 before 4.6.0.105, from 4.7.0.0 before 4.7.0.103.

02 Nov 2023, 15:44

Type Values Removed Values Added
First Time Netmodule nb1810
Netmodule nb1800
Netmodule nb2810
Netmodule nb800
Netmodule nb1601
Netmodule ng800
Netmodule nb3701
Netmodule nb2800
Netmodule nb3800
CPE cpe:2.3:h:netmodule:nb3800:-:*:*:*:*:*:*:*
cpe:2.3:h:netmodule:nb1601:-:*:*:*:*:*:*:*
cpe:2.3:h:netmodule:ng800:-:*:*:*:*:*:*:*
cpe:2.3:h:netmodule:nb3701:-:*:*:*:*:*:*:*
cpe:2.3:h:netmodule:nb1810:-:*:*:*:*:*:*:*
cpe:2.3:h:netmodule:nb800:-:*:*:*:*:*:*:*
cpe:2.3:h:netmodule:nb1800:-:*:*:*:*:*:*:*
cpe:2.3:h:netmodule:nb2810:-:*:*:*:*:*:*:*
cpe:2.3:h:netmodule:nb2800:-:*:*:*:*:*:*:*
Information

Published : 2023-02-16 09:15

Updated : 2024-02-28 19:51

NVD link : CVE-2023-0861

Mitre link : CVE-2023-0861

CVE.ORG link : CVE-2023-0861

JSON object : View

Products Affected

netmodule

  • netmodule_router_software
  • nb3800
  • nb2800
  • nb1601
  • ng800
  • nb1800
  • nb3701
  • nb2810
  • nb800
  • nb1810
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')