CVE-2023-40221

Katalog CVE

CVSS 8.8 · High EPSS 0,65%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada socomec modulys gp firmware. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

The absence of filters when loading some sections in the web application of the vulnerable device allows potential attackers to inject malicious code that will be interpreted when a legitimate user accesses the web section (MAIL SERVER) where the information is displayed. Injection can be done on parameter MAIL_RCV. When a legitimate user attempts to review NOTIFICATION/MAIL SERVER, the injected code will be executed.

Rincian

Terbit di NVD

18 September 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

0,65% peluang dieksploitasi; lebih tinggi dari 49,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-03 advisory pihak ketiga · pemerintah AS