CVE-2023-46306

Summary

CVE-2023-46306 is a vulnerability affecting the NetModule Router Software (NRSW) version 4.6 before 4.6.0.106 and 4.8 before 4.8.0.101. The issue lies in the web administration interface, where user input in the /admin/gnssAutoAlign.php "device_id" parameter is not properly sanitized, allowing for the injection of shell metacharacters. This vulnerability arises due to another thread being initiated before the cleanup function is triggered. An attacker who successfully exploits this vulnerability could execute arbitrary commands with elevated privileges, distinguishing it from CVE-2023-0861 and CVE-2023-0862, which were separately addressed in version 4.6.0.105.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.