CVE-2023-41344 describes a path traversal vulnerability in NCSIST ManageEngine Mobile Device Manager (MDM) APP. This flaw allows an unauthenticated remote attacker to bypass authentication and read arbitrary system files, posing a significant risk to data confidentiality. With a CVSS score of 7.5 (HIGH), the vulnerability is easily exploitable over the network with low attack complexity and no user interaction required. While there is no evidence of active exploitation, public exploit code, or Metasploit/Nuclei modules, the vulnerability has garnered minimal community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
1.4CPE matchmatch criteria | cpe:2.3:a:ncsist:mobile_device_manager:1.4:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.