VulnerabilityAnalyzed

CVE-2023-29492

Novi Survey Insecure Deserialization Vulnerability

KEVCRITICAL 9.8EPSS 2.69%

Does this matter?

Known to be exploited in the wild (CISA KEV, CISA remediation deadline 4 May 2023). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.

Description

Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account. This does not provide access to stored survey or response data.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 2.69% probability · 86th percentile
Public exploits: None in Exploit-DB
CISA KEV: Listed 13 April 2023 · due 4 May 2023
Weakness: CWE-94
Affected: 3rdmill/novi survey
Source: cve@mitre.org

EPSS trend

EPSS 2.7% since 30 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

CISA notes

Apply updates per vendor instructions. https://novisurvey.net/blog/novi-survey-security-advisory-apr-2023.aspx; https://nvd.nist.gov/vuln/detail/CVE-2023-29492

References

https://novisurvey.net/blog/novi-survey-security-advisory-apr-2023.aspxVendor Advisory
https://novisurvey.net/blog/novi-survey-security-advisory-apr-2023.aspxVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-29492US Government Resource

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.