CVE-2023-29492
Critical 9.8 Exploited in the wild (KEV)
Confirmed active exploitation — CISA KEV catalog
- Name
- Novi Survey Insecure Deserialization Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account. This does not provide access to stored survey or response data.
Metrics
- CVSS 3.1
-
9.8 (CRITICAL)
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 3% (percentile: 86) as of 2 November 2026
- CWE
- CWE-94
Affected products
3rdmill: novi survey
References
- https://novisurvey.net/blog/novi-survey-security-advisory-apr-2023.aspx Vendor Advisory
- https://novisurvey.net/blog/novi-survey-security-advisory-apr-2023.aspx Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023… US Government Resource