CVE-2023-29492: Novi Survey code injection allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 pre-auth network RCE combined with CISA KEV listing indicates active exploitation and urgent remediation need.

What it is

Novi Survey before 8.9.43676 contains a code injection flaw (CWE-94) that lets remote attackers execute arbitrary code on the server under the service account. The vendor advisory and CISA KEV entry describe it as an insecure deserialization vulnerability. Because it is network-reachable with no privileges or user interaction, it is a serious pre-auth RCE risk for exposed instances.

Impact

An attacker gains arbitrary code execution in the context of the Novi Survey service account, which can lead to full server compromise. The record states this does not provide access to stored survey or response data.

Attack surface

Reachable over the network per the CVSS vector AV:N/AC:L/PR:N/UI:N, meaning no authentication and no user interaction are required. Any internet- or network-exposed Novi Survey instance below 8.9.43676 is in scope.

Exploitation

CISA added it to KEV on 2023-04-13 with a 2023-05-04 remediation due date, indicating known exploitation; EPSS 30-day probability is 0.0269 (85th percentile). No ransomware campaign use is documented.

What to do

• Upgrade Novi Survey to 8.9.43676 or later immediately per the vendor advisory.
• If patching cannot be done at once, remove the instance from internet exposure and restrict access to trusted networks.
• Run the Novi Survey service under a least-privileged account to limit the impact of code execution.
• Monitor vendor and CISA guidance for any additional interim mitigations.

Detection

• Review web server and application logs for unexpected POST requests or deserialization-related errors against Novi Survey endpoints.
• Monitor for child processes spawned by the Novi Survey service account, especially command shells or scripting interpreters.
• Alert on outbound network connections originating from the Novi Survey host to unfamiliar destinations.
• Audit file writes or new executables in Novi Survey application directories and service-account-writable paths.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.