Novi Survey Insecure Deserialization Vulnerability

CRITICAL 9.8EXPLOITED (CISA KEV)CVE-2023-29492 · Published 11/04/2023 · updated 17/06/2026

Novi Survey Insecure Deserialization Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 13/04/2023. Patch affected systems as an emergency.

In short

CVE-2023-29492 is a CRITICAL (CVSS 9.8) vulnerability affecting novi survey (3rdmill).
Exploited in the wild: CISA added it to the KEV catalog on 13/04/2023.
Chance of exploitation in the next 30 days (EPSS): 2.7%, higher than 85.9% of all vulnerabilities.
Fix: update to 8.9.43676 or later.

Package	Affected versions	Patched versions
novi survey 3rdmill	`< 8.9.43676`	`8.9.43676`

Description

Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account. This does not provide access to stored survey or response data.

References

novisurvey.net/blog/novi-survey-security-advisory-apr-2023.aspx · Vendor Advisory
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2023-29492

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free