The NetModule NSRW web administration interface is vulnerable to path traversals, which could lead to arbitrary file uploads and deletion. By uploading malicious files to the web root directory, authenticated users could gain remote command execution with elevated privileges.
This issue affects NSRW: from 4.3.0.0 before 4.3.0.119, from 4.4.0.0 before 4.4.0.118, from 4.6.0.0 before 4.6.0.105, from 4.7.0.0 before 4.7.0.103.
References
| Link | Resource |
|---|---|
| https://onekey.com/blog/security-advisory-netmodule-multiple-vulnerabilities/ | Third Party Advisory |
| https://share.netmodule.com/public/system-software/4.7/4.7.0.103/NRSW-RN-4.7.0.103.pdf | Release Notes Vendor Advisory |
| https://onekey.com/blog/security-advisory-netmodule-multiple-vulnerabilities/ | Third Party Advisory |
| https://share.netmodule.com/public/system-software/4.7/4.7.0.103/NRSW-RN-4.7.0.103.pdf | Release Notes Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
21 Nov 2024, 07:37
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://onekey.com/blog/security-advisory-netmodule-multiple-vulnerabilities/ - Third Party Advisory | |
| References | () https://share.netmodule.com/public/system-software/4.7/4.7.0.103/NRSW-RN-4.7.0.103.pdf - Release Notes, Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.2 |
07 Nov 2023, 04:01
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | The NetModule NSRW web administration interface is vulnerable to path traversals, which could lead to arbitrary file uploads and deletion. By uploading malicious files to the web root directory, authenticated users could gain remote command execution with elevated privileges. This issue affects NSRW: from 4.3.0.0 before 4.3.0.119, from 4.4.0.0 before 4.4.0.118, from 4.6.0.0 before 4.6.0.105, from 4.7.0.0 before 4.7.0.103. |
02 Nov 2023, 15:47
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Netmodule nb1810
Netmodule nb1800 Netmodule nb2810 Netmodule nb800 Netmodule nb1601 Netmodule ng800 Netmodule nb3701 Netmodule nb2800 Netmodule nb3800 |
|
| CPE | cpe:2.3:h:netmodule:nb3800:-:*:*:*:*:*:*:* cpe:2.3:h:netmodule:nb1601:-:*:*:*:*:*:*:* cpe:2.3:h:netmodule:ng800:-:*:*:*:*:*:*:* cpe:2.3:h:netmodule:nb3701:-:*:*:*:*:*:*:* cpe:2.3:h:netmodule:nb1810:-:*:*:*:*:*:*:* cpe:2.3:h:netmodule:nb800:-:*:*:*:*:*:*:* cpe:2.3:h:netmodule:nb1800:-:*:*:*:*:*:*:* cpe:2.3:h:netmodule:nb2810:-:*:*:*:*:*:*:* cpe:2.3:h:netmodule:nb2800:-:*:*:*:*:*:*:* |
Information
Published : 2023-02-16 10:15
Updated : 2024-11-21 07:37
NVD link : CVE-2023-0862
Mitre link : CVE-2023-0862
CVE.ORG link : CVE-2023-0862
JSON object : View
Products Affected
netmodule
- nb1800
- nb2800
- nb1810
- ng800
- netmodule_router_software
- nb3800
- nb800
- nb2810
- nb1601
- nb3701
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')