ZeroDay Findings
Sign inSign up

Findings

CVE-2023-29492

Novi Survey Insecure Deserialization Vulnerability

Published Apr 10, 2023 · updated Jun 16, 2026 · 3rdmill novi survey

Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account. This does not provide access to stored survey or response data.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 10, 2023 · Catalog

    Detected

    Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account. This does not provide access to stored survey or response data.

  2. Apr 13, 2023 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. May 4, 2023 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account. This does not provide access to stored survey or response data.

Required action

Apply updates per vendor instructions.

CISA due date May 4, 2023

Affected

  • cpe 3rdmill/novi surveyversion unspecified
  • vendor Novi Survey Novi Surveyversion unspecified

Sources

  • CISA KEVCVE-2023-29492

    Novi Survey contains an insecure deserialization vulnerability that allows remote attackers to execute code on the server in the context of the service account.

    cisa.gov
  • CVE.orgCVE-2023-29492

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2023-29492

    30-day exploitation probability 2.7%

    first.org
  • NIST NVDCVE-2023-29492

    Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account. This does not provide access to stored survey or response data.

    nvd.nist.gov

References