CVE-2023-2907 Marksoft CVE debrief

Who should care

Security teams, application owners, and administrators responsible for Marksoft deployments, especially Marksoft Mobile instances at or below version 7.1.7. Organizations exposing the affected service to untrusted networks should prioritize review immediately.

Technical summary

The vulnerability is an improper neutralization of special elements used in an SQL command (CWE-89 / SQL injection). NVD reports CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates remote exploitability without privileges or user interaction and the potential for full confidentiality, integrity, and availability impact. The CVE description names multiple Marksoft components, but the NVD CPE criteria specifically confirm vulnerability in cpe:2.3:a:marksoft:marksoft:*:*:*:*:mobile:*:*:* through version 7.1.7.

Defensive priority

Immediate. The combination of CVSS 9.8, network attack vector, no privileges required, and high impact makes this a top-priority remediation item.

Recommended defensive actions

• Identify all Marksoft deployments, with special focus on Marksoft Mobile versions at or below 7.1.7.
• Apply the vendor fix or upgrade to a version newer than the affected release as soon as one is available.
• Review the USOM advisory linked in NVD for any vendor-specific remediation guidance.
• Restrict exposure of the affected application and place compensating controls around any internet-facing instances until remediated.
• Monitor application and database logs for anomalous query patterns, unexpected errors, or signs of unauthorized data access.
• Validate that input handling and parameterized database access are in place during remediation verification.
• Confirm whether the Login 1.4 and API:20230605 components mentioned in the CVE description are present in your environment and assess them alongside the NVD-confirmed Mobile exposure.

Evidence notes

Primary evidence comes from the official NVD record and the CVE record. The CVE was published on 2023-06-19 and later modified on 2024-11-21. NVD lists the weakness as CWE-89 and provides the CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The supplied NVD metadata also includes a USOM third-party advisory reference. The description names Mobile v7.1.7, Login 1.4, and API:20230605, while the CPE criteria specifically confirm Marksoft Mobile through 7.1.7.

Official resources