{"id":"CVE-2023-46306","aliases":["EUVD-2023-50528","GHSA-4qww-v3r6-7335"],"status":"published","title":"The web administration interface in NetModule Router Software (NRSW) 4.6 before 4.6.0.106 and 4.8...","description":"The web administration interface in NetModule Router Software (NRSW) 4.6 before 4.6.0.106 and 4.8 before 4.8.0.101 executes an OS command constructed with unsanitized user input: shell metacharacters in the /admin/gnssAutoAlign.php device_id parameter. This occurs because another thread can be started before the trap that triggers the cleanup function. A successful exploit could allow an authenticated user to execute arbitrary commands with elevated privileges. NOTE: this is different from CVE-2023-0861 and CVE-2023-0862, which were fixed in version 4.6.0.105.","severity":{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AC:L/AV:A/A:H/C:H/I:H/PR:H/S:C/UI:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01247,"percentile":0.69525,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2023-10-22T00:00:00Z","modified":"2026-06-17T06:30:37Z","products":[{"vendor":"netmodule","product":"netmodule_router_software"}],"references":[{"url":"https://share.netmodule.com/public/system-software/4.8/4.8.0.101/NRSW-RN-4.8.0.101.pdf","tags":["x_transferred","Release Notes"]},{"url":"https://share.netmodule.com/public/system-software/4.6/4.6.0.106/NRSW-RN-4.6.0.106.pdf","tags":["x_transferred","Release Notes"]},{"url":"https://pentest.blog/advisory-netmodule-router-software-race-condition-leads-to-remote-code-execution/","tags":["x_transferred","Product","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46306"},{"url":"https://pentest.blog/advisory-netmodule-router-software-race-condition-leads-to-remote-code-execution"},{"url":"https://github.com/advisories/GHSA-4qww-v3r6-7335"}],"sources":{"cve":[{"id":"CVE-2023-46306","description":"The web administration interface in NetModule Router Software (NRSW) 4.6 before 4.6.0.106 and 4.8 before 4.8.0.101 executes an OS command constructed with unsanitized user input: shell metacharacters in the /admin/gnssAutoAlign.php device_id parameter. This occurs because another thread can be started before the trap that triggers the cleanup function. A successful exploit could allow an authenticated user to execute arbitrary commands with elevated privileges. NOTE: this is different from CVE-2023-0861 and CVE-2023-0862, which were fixed in version 4.6.0.105.","status":"published","published":"2023-10-22T00:00:00Z","modified":"2024-09-12T18:22:55.873Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AC:L/AV:A/A:H/C:H/I:H/PR:H/S:C/UI:N","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:35:23.309349Z"}],"euvd":[{"id":"EUVD-2023-50528","description":"The web administration interface in NetModule Router Software (NRSW) 4.6 before 4.6.0.106 and 4.8 before 4.8.0.101 executes an OS command constructed with unsanitized user input: shell metacharacters in the /admin/gnssAutoAlign.php device_id parameter. This occurs because another thread can be started before the trap that triggers the cleanup function. A successful exploit could allow an authenticated user to execute arbitrary commands with elevated privileges. NOTE: this is different from CVE-2023-0861 and CVE-2023-0862, which were fixed in version 4.6.0.105.","status":"published","published":"2023-10-22T00:00:00Z","modified":"2024-09-12T18:22:55Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AC:L/AV:A/A:H/C:H/I:H/PR:H/S:C/UI:N","level":"high"}],"updated_at":"2026-11-03T00:55:56.835723Z"}],"ghsa":[{"id":"GHSA-4qww-v3r6-7335","title":"The web administration interface in NetModule Router Software (NRSW) 4.6 before 4.6.0.106 and 4.8...","description":"The web administration interface in NetModule Router Software (NRSW) 4.6 before 4.6.0.106 and 4.8 before 4.8.0.101 executes an OS command constructed with unsanitized user input: shell metacharacters in the /admin/gnssAutoAlign.php device_id parameter. This occurs because another thread can be started before the trap that triggers the cleanup function. A successful exploit could allow an authenticated user to execute arbitrary commands with elevated privileges. NOTE: this is different from CVE-2023-0861 and CVE-2023-0862, which were fixed in version 4.6.0.105.","status":"published","published":"2023-10-22T21:36:10Z","modified":"2024-09-12T21:33:03Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:58:15.26738Z"}],"nvd":[{"id":"CVE-2023-46306","description":"The web administration interface in NetModule Router Software (NRSW) 4.6 before 4.6.0.106 and 4.8 before 4.8.0.101 executes an OS command constructed with unsanitized user input: shell metacharacters in the /admin/gnssAutoAlign.php device_id parameter. This occurs because another thread can be started before the trap that triggers the cleanup function. A successful exploit could allow an authenticated user to execute arbitrary commands with elevated privileges. NOTE: this is different from CVE-2023-0861 and CVE-2023-0862, which were fixed in version 4.6.0.105.","status":"published","published":"2023-10-22T21:15:07.93Z","modified":"2026-06-17T06:30:37.533Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:08:39.058878Z"}]}}