CVE-2023-46306

🗓️ 22 Oct 2023 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 60 Views🌐 WEB

The web administration interface in NetModule Router Software (NRSW) 4.6 before 4.6.0.106 and 4.8 before 4.8.0.101 allows authenticated users to execute arbitrary commands with elevated privileges

Reporter	Title	Published	Views	Family All 10
ATTACKERKB	CVE-2023-46306	22 Oct 202321:15	–	attackerkb
Circl	CVE-2023-46306	23 Oct 202300:39	–	circl
CNNVD	NetModule Router Software Operating System Command Injection Vulnerability	22 Oct 202300:00	–	cnnvd
Cvelist	CVE-2023-46306	22 Oct 202300:00	–	cvelist
EUVD	EUVD-2023-50528	3 Oct 202520:07	–	euvd
NVD	CVE-2023-46306	22 Oct 202321:15	–	nvd
OSV	CVE-2023-46306	22 Oct 202321:15	–	osv
Prion	Design/Logic Flaw	22 Oct 202321:15	–	prion
Positive Technologies	PT-2023-29948 · Netmodule · Netmodule Router	22 Oct 202300:00	–	ptsecurity
Vulnrichment	CVE-2023-46306	22 Oct 202300:00	–	vulnrichment

NVD

Vulnrichment

Node

netmodule netmodule_router_softwareRange<4.6.0.105

netmodule netmodule_router_softwareRange4.7.0.0–4.7.0.103

AND

netmodule nb1601Match-

netmodule nb1800Match-

netmodule nb1810Match-

netmodule nb2800Match-

netmodule nb2810Match-

netmodule nb3701Match-

netmodule nb3800Match-

netmodule ng800Match-

Source	Link
share	www.share.netmodule.com/public/system-software/4.6/4.6.0.106/NRSW-RN-4.6.0.106.pdf
share	www.share.netmodule.com/public/system-software/4.8/4.8.0.101/NRSW-RN-4.8.0.101.pdf
pentest	www.pentest.blog/advisory-netmodule-router-software-race-condition-leads-to-remote-code-execution/

Parameter	Position	Path	Description	CWE
device_id	query param	/admin/gnssAutoAlign.php	OS command execution via unsanitized device_id parameter leading to potential arbitrary command execution.	CWE-78

21 Nov 2024 08:28Current

7.9High risk

Vulners AI Score7.9

CVSS 3.16.6 - 8.4

EPSS0.00961

SSVC

CWE-78