CVE-2023-40221

· HIGHModified

← All CVEs

CVSS v3.1

8.8

EPSS

0.53%

Published

Sep 18, 2023

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

The absence of filters when loading some sections in the web application of the vulnerable device allows potential attackers to inject malicious code that will be interpreted when a legitimate user accesses the web section (MAIL SERVER) where the information is displayed. Injection can be done on parameter MAIL_RCV. When a legitimate user attempts to review NOTIFICATION/MAIL SERVER, the injected code will be executed.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-94

Affected Products (2)

socomec · modulys_gp_firmwarevulnerable

socomec · modulys_gp

References (2)

https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-03

Third Party AdvisoryUS Government Resource

https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-03

Third Party AdvisoryUS Government Resource

KEV Catalog EPSS Scores Vendors All CVEs