The NetModule NSRW web administration interface is vulnerable to path traversals, which could lead to arbitrary file uploads and deletion. By uploading malicious files to the web root directory, authenticated users could gain remote command execution with elevated privileges. This issue affects NSRW: from 4.3.0.0 before 4.3.0.119, from 4.4.0.0 before 4.4.0.118, from 4.6.0.0 before 4.6.0.105, from 4.7.0.0 before 4.7.0.103.
References
| Link | Resource |
|---|---|
| https://onekey.com/blog/security-advisory-netmodule-multiple-vulnerabilities/ | Third Party Advisory |
| https://share.netmodule.com/public/system-software/4.7/4.7.0.103/NRSW-RN-4.7.0.103.pdf | Release Notes Vendor Advisory |
| https://onekey.com/blog/security-advisory-netmodule-multiple-vulnerabilities/ | Third Party Advisory |
| https://share.netmodule.com/public/system-software/4.7/4.7.0.103/NRSW-RN-4.7.0.103.pdf | Release Notes Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
21 Nov 2024, 07:37
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://onekey.com/blog/security-advisory-netmodule-multiple-vulnerabilities/ - Third Party Advisory | |
| References | () https://share.netmodule.com/public/system-software/4.7/4.7.0.103/NRSW-RN-4.7.0.103.pdf - Release Notes, Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.2 |
24 Feb 2023, 18:13
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-02-16 10:15
Updated : 2024-11-21 07:37
NVD link : CVE-2023-0862
Mitre link : CVE-2023-0862
CVE.ORG link : CVE-2023-0862
JSON object : View
Products Affected
netmodule
- nb1800
- nb1601
- nb3800
- netmodule_router_software
- nb1810
- nb800
- nb2800
- nb3701
- ng800
- nb2810
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')