Novi Survey Insecure Deserialization Vulnerability

Novi Survey contains an insecure deserialization vulnerability that allows remote attackers to execute code on the server in the context of the service account.

cat cve-2023-29492.json

Vendor: Novi Survey
Product: Novi Survey
CVSS: 9.8
EPSS (exploit probability): 2.7%
Status: kev
CISA patch-by (BOD 22-01): May 4, 2023
Published: April 13, 2023
Source: https://nvd.nist.gov/vuln/detail/CVE-2023-29492

Novi Survey contains an insecure deserialization vulnerability that allows remote attackers to execute code on the server in the context of the service account.

Added to CISA’s Known Exploited Vulnerabilities catalog on 2023-04-13. Required action per CISA: Apply updates per vendor instructions. Due date: 2023-05-04.

This is an auto-synced KEV catalog record pending a full 0dayNews write-up — see CISA’s KEV catalog and the NVD record linked above for primary sources.