TI-2023-26241 Aliases CVE-2023-48383 GHSA-hp2p-9hx2-9xjf

NetVision Information airPASS - Path Traversal

MEDIUM 41CWE-22Published 2024-01-15 · Updated 2025-06-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

NetVision Information airPASS has a path traversal vulnerability within its parameter in a specific URL. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and download arbitrary system files.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0098 62nd percentileScored 2026-11-07

Fix Fixed airPASS (NetVision Information): v2.9.0.231006

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
NetVision Information	airPASS	v2.9.0.200703	v2.9.0.231006	Patch available	CNA

airPASS VendorNetVision Information Affected v2.9.0.200703 Fixed in v2.9.0.231006 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:netvision:airpass:2.9.0.200703:::::::*	2.9.0.200703	Vulnerable	Netvision

cpe:2.3:a:netvision:airpass:2.9.0.200703:*:*:*:*:*:*:* Versions 2.9.0.200703 Vulnerable ·Netvision

Remediation

Fix · CNA airPASS (NetVision Information) Fixed in v2.9.0.231006

Timeline

2026-10-02 Threatist record created from CVE-2023-48383
2026-10-03 Alias added: GHSA-hp2p-9hx2-9xjf

References

Advisory 1

https://www.twcert.org.tw/tw/cp-132-7631-c6be3-1.html

TI-2025-00373 NetVision Information airPASS - Missing Authentication CVSS 3.1CRITICAL 9.8
TI-2025-00372 NetVision Information airPASS - SQL injection CVSS 3.1CRITICAL 9.8
TI-2025-00374 NetVision Information airPASS - OS Command Injection CVSS 3.1HIGH 8.8
TI-2025-00970 NetVision Information ISOinsight - Reflected Cross-site Scripting CVSS 3.1MEDIUM 6.1
TI-2025-14007 NetVision Information｜ISOinsight - Reflected Cross-site Scripting CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences