Novi Survey Insecure Deserialization Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Apr 10, 2023 · Catalog

   Detected

   Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account. This does not provide access to stored survey or response data.

2. Apr 13, 2023 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. May 4, 2023 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Jun 16, 2026 · Catalog

   Updated

   Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account. This does not provide access to stored survey or response data.

Affected

• cpe 3rdmill/novi surveyversion unspecified
• vendor Novi Survey Novi Surveyversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2023-29492

  Novi Survey contains an insecure deserialization vulnerability that allows remote attackers to execute code on the server in the context of the service account.

  cisa.gov
• CVE.orgVulnerability recordCVE-2023-29492

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2023-29492

  30-day exploitation probability 2.7%

  first.org
• NIST NVDVulnerability recordCVE-2023-29492

  Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account. This does not provide access to stored survey or response data.

  nvd.nist.gov

References

• CISA note · novisurvey.net
• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov