Novi Survey Remote Code Execution (RCE) Vulnerability Security Advisory (CVE-2023-29492)
Executive & SecOps Summary
SECOPS ASSESSMENTAll on-premises and cloud web application servers running Novi Survey versions prior to 8.9.43676.
Unauthenticated remote attackers can execute arbitrary system commands and malicious code under the security context of the web service account.
Immediately upgrade to the official patched version (8.9.43676 or higher) and restrict external access to the application.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the official security patch provided by Novi Survey. Use the following PowerShell script to verify the currently installed version and plan the upgrade to version 8.9.43676 or later.
# 1. Check the current Novi Survey DLL version to determine vulnerability status
$assemblyPath = 'C:\inetpub\wwwroot\
ovisurvey\bin\NoviSurvey.dll'
if (Test-Path $assemblyPath) {
$fileVersion = [System.Diagnostics.FileVersionInfo]::GetVersionInfo($assemblyPath).FileVersion
Write-Host 'Currently installed Novi Survey version:' $fileVersion
# If the version is lower than 8.9.43676, immediate upgrade is required
}2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, restrict access to the Novi Survey application using IIS URL Rewrite rules or network-level firewalls to allow only trusted IP addresses.
<!-- Example IIS web.config rule to restrict access to specific IP ranges -->
<configuration>
<system.webServer>
<rewrite>
<rules>
<rule name='IP Restriction' stopProcessing='true'>
<match url='.*' />
<conditions>
<add input='{REMOTE_ADDR}' pattern='^192\.168\.' negate='true' />
<add input='{REMOTE_ADDR}' pattern='^10\.' negate='true' />
</conditions>
<action type='CustomResponse' statusCode='403' statusReason='Forbidden' statusDescription='Access Denied' />
</rule>
</rules>
</rewrite>
</system.webServer>
</configuration>3. Log Audit & IoC Verification Commands
Analyze IIS W3C logs for anomalous POST requests and monitor the web root directory for newly created or modified web shells (.aspx, .ashx) using the following PowerShell command.
# Scan for ASPX/ASHX files created or modified within the last 14 days
Get-ChildItem -Path 'C:\inetpub\wwwroot\
ovisurvey' -Recurse -Include *.aspx, *.ashx, *.asmx |
Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
Select-Object FullName, LastWriteTime, Length |
Format-Table -AutoSizeBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2023-29492) is a critical Remote Code Execution (RCE) flaw in the Novi Survey enterprise survey platform. The root cause lies in insufficient input validation and unsafe deserialization or dynamic code execution mechanisms (CWE-94) within the application. An unauthenticated attacker can exploit this by sending a specially crafted HTTP request to vulnerable endpoints, forcing the server to execute arbitrary code.
2. Exploitation Mechanics & Attack Scenario
An unauthenticated external attacker scans for publicly accessible Novi Survey endpoints. By leveraging insecure deserialization or code injection vectors, the attacker injects a malicious payload into the HTTP request parameters. When the .NET-based application processes this request, it deserializes or executes the payload without proper sanitization, resulting in the execution of OS commands or web shells under the privileges of the IIS application pool identity (e.g., IIS_IUSRS or Network Service).
3. Infrastructure & Business Impact
With a CVSS score of 9.8 (Critical), this vulnerability poses an extreme risk and is actively exploited in the wild, as confirmed by its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog. Although it does not directly expose stored survey databases via SQL injection, a successful compromise grants full control over the host server. This allows attackers to establish persistence, deploy ransomware, perform lateral movement within the internal network, or exfiltrate sensitive system data.
Official Vendor Advisories & References
Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account. This does not provide access to stored survey or response data.
Frequently Asked SecOps Questions (CVE-2023-29492)
FAQQ1. How critical is CVE-2023-29492 and is it actively exploited in the wild?
CVE-2023-29492 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 2.7%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2023-29492?
Primary impacted vendors include novi survey across novi survey. Scope summary: All Novi Survey versions prior to 8.9.43676
Q3. What temporary mitigations or workarounds exist for CVE-2023-29492 before patching?
[Mitigation] Immediately upgrade to the official patched version (8.9.43676 or higher) and restrict external access to the application. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2023-29492
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (novi survey)
View Category →IBM Langflow OSS Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-9198)
[Affected Scope] IBM Langflow OSS versions 1.0.0 through 1.10.0 in default deployments
Langflow Unauthenticated Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-33017)
[Affected Scope] Langflow versions prior to 1.9.0
Microsoft SharePoint Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-65660)
[Affected Scope] Microsoft SharePoint Server 2016, 2019, and Subscription Edition.
Apache ActiveMQ Jolokia JMX-HTTP Bridge Remote Code Execution Vulnerability Advisory (CVE-2026-34197)
[Affected Scope] Apache ActiveMQ Classic versions prior to 5.19.4, and 6.0.0 through 6.2.3
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.