CVE-2023-46306

Published: Oct 22, 2023Modified: Nov 21, 2024

6.6

Vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 0.7 / Impact: 5.9

Source: NVD

Description

The web administration interface in NetModule Router Software (NRSW) 4.6 before 4.6.0.106 and 4.8 before 4.8.0.101 executes an OS command constructed with unsanitized user input: shell metacharacters in the /admin/gnssAutoAlign.php device_id parameter. This occurs because another thread can be started before the trap that triggers the cleanup function. A successful exploit could allow an authenticated user to execute arbitrary commands with elevated privileges. NOTE: this is different from CVE-2023-0861 and CVE-2023-0862, which were fixed in version 4.6.0.105.

Affected (2)

Products: Netmodule: Netmodule Router Software

Netmodule

1 product

Netmodule Router Software

Configuration A

2 vulnerable · 8 platform

Vulnerable Software	Affected Versions
Netmodule Netmodule Router Software	Before 4.6.0.105
Netmodule Netmodule Router Software	From 4.7.0.0 to 4.7.0.103

Running on/with	Platform Versions
Netmodule Nb1601	All versions
Netmodule Nb1800	All versions
Netmodule Nb1810	All versions
Netmodule Nb2800	All versions
Netmodule Nb2810	All versions
Netmodule Nb3701	All versions
Netmodule Nb3800	All versions
Netmodule Ng800	All versions