« Volver al listado

CVE-2023-0862

Estado: ModificadaAlta (8.8)—

The NetModule NSRW web administration interface is vulnerable to path traversals, which could lead to arbitrary file uploads and deletion. By uploading malicious files to the web root directory, authenticated users could gain remote command execution with elevated privileges.

This issue affects NSRW: from 4.3.0.0 before 4.3.0.119, from 4.4.0.0 before 4.4.0.118, from 4.6.0.0 before 4.6.0.105, from 4.7.0.0 before 4.7.0.103.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Netmodule — Netmodule Router Software

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-0862",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-0862",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-03-18T14:50:33.476944Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "research@onekey.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "research@onekey.com",
      "affectedData": [
        {
          "vendor": "NetModule",
          "modules": [
            "web administration interface"
          ],
          "product": "NSRW",
          "versions": [
            {
              "status": "affected",
              "version": "4.3.0.0",
              "lessThan": "4.3.0.119",
              "versionType": "4.3.0.119"
            },
            {
              "status": "affected",
              "version": "4.4.0.0",
              "lessThan": "4.4.0.118",
              "versionType": "4.4.0.118"
            },
            {
              "status": "affected",
              "version": "4.6.0.0",
              "lessThan": "4.6.0.105",
              "versionType": "4.6.0.105"
            },
            {
              "status": "affected",
              "version": "4.7.0.0",
              "lessThan": "4.7.0.103",
              "versionType": "4.7.0.103"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-02-16T10:15:11.983",
  "references": [
    {
      "url": "https://onekey.com/blog/security-advisory-netmodule-multiple-vulnerabilities/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "research@onekey.com"
    },
    {
      "url": "https://share.netmodule.com/public/system-software/4.7/4.7.0.103/NRSW-RN-4.7.0.103.pdf",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "research@onekey.com"
    },
    {
      "url": "https://onekey.com/blog/security-advisory-netmodule-multiple-vulnerabilities/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://share.netmodule.com/public/system-software/4.7/4.7.0.103/NRSW-RN-4.7.0.103.pdf",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "research@onekey.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The NetModule NSRW web administration interface is vulnerable to path traversals, which could lead to arbitrary file uploads and deletion. By uploading malicious files to the web root directory, authenticated users could gain remote command execution with elevated privileges.\n\nThis issue affects NSRW: from 4.3.0.0 before 4.3.0.119, from 4.4.0.0 before 4.4.0.118, from 4.6.0.0 before 4.6.0.105, from 4.7.0.0 before 4.7.0.103.\n"
    }
  ],
  "lastModified": "2026-06-17T05:26:30.410",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:netmodule:netmodule_router_software:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FA6AD24E-E27F-4078-8066-AB0E0D1CAA33",
              "versionEndExcluding": "4.3.0.119",
              "versionStartIncluding": "4.3.0.0"
            },
            {
              "criteria": "cpe:2.3:a:netmodule:netmodule_router_software:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8000F0E9-A55B-472E-B71E-20097FC15C58",
              "versionEndExcluding": "4.4.0.118",
              "versionStartIncluding": "4.4.0.0"
            },
            {
              "criteria": "cpe:2.3:a:netmodule:netmodule_router_software:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EFFBFAD7-53CB-4755-A338-2FE945B3689F",
              "versionEndExcluding": "4.6.0.105",
              "versionStartIncluding": "4.6.0.0"
            },
            {
              "criteria": "cpe:2.3:a:netmodule:netmodule_router_software:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B543F356-8395-4F7E-A3C8-1A5DB362533C",
              "versionEndExcluding": "4.7.0.103",
              "versionStartIncluding": "4.7.0.0"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:netmodule:nb1601:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "5C90BC32-C405-4178-B944-9CF39C212C46"
            },
            {
              "criteria": "cpe:2.3:h:netmodule:nb1800:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A80AE348-C415-4B5F-B359-26E2F2A132F7"
            },
            {
              "criteria": "cpe:2.3:h:netmodule:nb1810:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A3CF8E81-2EB5-4CDC-9FC9-CEAF4E1E7514"
            },
            {
              "criteria": "cpe:2.3:h:netmodule:nb2800:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "EFF579A1-A31C-47F3-912A-43F5B4894497"
            },
            {
              "criteria": "cpe:2.3:h:netmodule:nb2810:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "41310FAF-CD23-4126-942D-DA950A96DF3E"
            },
            {
              "criteria": "cpe:2.3:h:netmodule:nb3701:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "962F7AFA-76A3-4F83-AA2C-AB168C644104"
            },
            {
              "criteria": "cpe:2.3:h:netmodule:nb3800:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "7120564A-4FE0-403E-A976-9658A665E51A"
            },
            {
              "criteria": "cpe:2.3:h:netmodule:nb800:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "3B550124-772B-4384-BA89-72B68E01F61E"
            },
            {
              "criteria": "cpe:2.3:h:netmodule:ng800:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "0408E588-146F-4AD2-9D58-A12EBA83A697"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "research@onekey.com"
}