{"id":"CVE-2023-29492","kind":"vulnerability","aliases":["CVE-2023-29492"],"related":[],"title":"3rdmill novi survey: Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the…","description":"Novi Survey contains an insecure deserialization vulnerability that allows remote attackers to execute code on the server in the context of the service account.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Novi Survey's installable (self-hosted) software has a remote code execution flaw (CVSS 9.8). Unauthenticated remote attackers can run code on the server as the service account. Survey and response data are not exposed directly. It is in CISA KEV (added 2023-04-13). The vendor-hosted service is not listed as affected.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2023-04-13T00:00:00+00:00","products":[{"name":"Novi Survey Novi Survey","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Novi Survey","fixed":["8.9.43676"],"affected":"< 8.9.43676","ecosystem":"vendor"},{"name":"3rdmill novi survey","fixed":["8.9.43676"],"affected":"< 8.9.43676","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["deserialization","exploited","novi-survey","rce","self-hosted","vendor"],"not_affected_if":["managed-hosting"],"how_to_check":"Check the installed Novi Survey version on the server (admin/about page or the installed product version). Anything below 8.9.43676 is vulnerable.","fix":"Upgrade the installation to Novi Survey 8.9.43676 or later. The vendor says there is no workaround for earlier versions.","status":"open","published_at":"2023-04-11T05:15:07+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:06:56+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-10-23T21:06:56Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor update per Novi Survey's instructions; the sources do not name a fixed version.","reach":"internet","impact":"high","summary":"Novi Survey, a survey and data-collection product, contains an insecure deserialization flaw. A remote attacker can execute code on the server under the service account the product runs as.","category":"vendor","who_cares":["novi-survey","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Remote code execution on the server as the service account","analyst_note":"Confirm affected and fixed versions and whether the product is self-hosted or vendor-hosted at the CISA KEV entry and the vendor advisory; the sources give no version data.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000438,"input_tokens":2789,"output_tokens":319,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm affected and fixed versions and whether the product is self-hosted or vendor-hosted at the CISA KEV entry and the vendor advisory; the sources give no version data.","search":"'-04':90B '-13':91B '-2023':22A,25A '-29492':23A,26A '2023':89B '3rdmill':1A,33A '8.9.43676':7A '9.8':61B 'account':74B,125C 'action':128C 'add':88B 'affect':101B 'allow':8A,110C 'appli':129C 'arbitrari':13A 'attack':10A,64B,112C 'cisa':86B,126C 'code':14A,57B,67B,115C 'contain':104C 'context':20A,121C 'cve':21A,24A 'cvss':60B 'data':78B 'deseri':36B,107C 'direct':82B 'execut':12A,58B,114C 'exploit':37B 'expos':81B 'flaw':59B 'host':44B,52B,95B 'insecur':106C 'instal':49B 'instruct':133C 'kev':87B 'list':99B 'novi':2A,4A,27A,29A,31A,34A,39B,46B,102C 'novi-survey':38B 'per':131C 'rce':41B 'remot':9A,56B,63B,111C 'requir':127C 'respons':77B 'run':66B 'self':43B,51B 'self-host':42B,50B 'server':17A,70B,118C 'servic':73B,96B,124C 'softwar':53B 'survey':3A,5A,28A,30A,32A,35A,40B,47B,75B,103C 'unauthent':62B 'updat':130C 'vendor':45B,94B,132C 'vendor-host':93B 'vulner':108C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-04-11T05:15:07+00:00","kev":{"dateAdded":"2023-04-13","dueDate":"2023-05-04","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-29492","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-29492","severity":null,"published_at":"2023-04-13T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T11:39:16+00:00","note":null},{"source":"analyst","external_id":"CVE-2023-29492:39","url":null,"severity":null,"published_at":"2026-10-23T21:07:17+00:00","modified_at":"2026-10-23T21:07:17+00:00","first_seen_at":"2026-10-23T21:07:17+00:00","fetched_at":"2026-10-23T21:07:17+00:00","note":"Vendor advisory (Apr 2023) says all installable versions < 8.9.43676 are affected, with no workaround; the fix is to upgrade. NVD and CISA KEV confirm exploitation. No public PoC link found."},{"source":"nvd","external_id":"CVE-2023-29492","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29492","severity":null,"published_at":"2023-04-11T05:15:07+00:00","modified_at":"2026-06-17T05:50:13+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[{"id":907,"url":"https://novisurvey.net/blog/novi-survey-security-advisory-apr-2023.aspx","title":"Novi Survey security advisory Apr-2023","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":908,"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29492","title":"NVD CVE-2023-29492","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}