CVE-2023-29492

Novi Survey before 8.9.43676 allows a remote attacker to execute arbitrary code on the server, running in the context of the service account. Unauthenticated and requiring no user interaction, this is a straightforward remote code execution against the application host. The advisory does add one scoping detail worth carrying forward: it does not, by itself, grant access to stored survey or response data.

Unauthenticated RCE is the top tier of what attackers hunt for, and code execution as the service account gives a solid foothold on the host regardless of the data-access caveat, defenders should read that caveat as 'the initial blast radius is the host, not necessarily the survey database' rather than as a reason to relax. Clean unauthenticated RCE in a named product is the kind of thing that gets weaponized and scanned for once details circulate.

Our angle is inventory plus exposure: identify any Novi Survey instances below 8.9.43676 and, critically, which are internet-reachable, since those are the ones at immediate risk. We would prioritize patching the exposed set hard, and constrain the service account's privileges so that RCE in that context is as contained as possible, limiting how far an attacker can pivot from the initial foothold.