CVE-2023-29492 kev in the critical feed json
Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account.
published 2023-04-11 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-33059
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Exploited
- added 2023-04-13
- epss
- 2.7%
- EPSS 2.7% chance of exploitation in 30 days, percentile 85%
- public exploits
- 0
- none known
Summary
Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account. This does not provide access to stored survey or response data.
Patch / fix
cisa required action Apply updates per vendor instructions.
- novisurvey novi_survey 8.9.43676
Timeline
- Published
- Added to CISA KEV
- CISA patch deadline
- CISA SSVC: exploitation active
Known exploited
- Added
- 3 y ago
- Patch by
- 2023-05-04 (3 y ago)
- Ransomware
- Not known
- Required action
- Apply updates per vendor instructions.
- Vendor, product
- Novi Survey, Novi Survey
- CISA name
- Novi Survey Insecure Deserialization Vulnerability
ATT&CK techniques
How it is exploited and what it leads to, in MITRE ATT&CK terms.
- T1190 Exploit Public-Facing Application exploitation
kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- yes
- Technical impact
- total
- Assessed
- 21 mo ago
Exploit prediction
2.69% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- novisurvey novi_survey
Classification
- Weakness
-
- CWE-94 Improper Control of Generation of Code
References
-
novisurvey.net
/blog/novi-survey-security-advisory-apr-2023.aspx
vendor-advisory
-
cisa.gov
/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-29492
government-resource, us-government-resource
Sources
- CVE List CVE-2023-29492
- NVD CVE-2023-29492
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.