Risk Letters

Exploited vulnerability

CVE-2023-29492

TLP:CLEAR

Novi Survey Insecure Deserialization Vulnerability

Novi Survey contains an insecure deserialization vulnerability that allows remote attackers to execute code on the server in the context of the service account.

Facts

  • Vendor: Novi Survey
  • Product: Novi Survey
  • CVSS: 9.8
  • EPSS (probability of exploitation within 30 days): 2.7 %
  • On CISA's Known Exploited Vulnerabilities list since: 13 April 2023
  • First known exploitation: 13 April 2023
  • CISA's deadline for US federal agencies: 4 May 2023
  • Weakness: CWE-94
  • First seen by Risk Letters: 13 April 2023

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD