CVE-2023-4667
High
Description
The web interface of the PAC Device allows the device administrator user profile to store malicious scripts in some fields. The stored malicious script is then executed when the GUI is opened by any users of the webserver administration interface. The root cause of the vulnerability is inadequate input validation and output encoding in the web administration interface component of the firmware. This could lead to unauthorized access and data leakage
SeverityHigh
CVSS8.1
Exploit probability—
ProductIdemia Sgima Lite \& Lite\+ Firmware
PublishedNov 28, 2023
First seenNov 28, 2023
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| idemia sgima_lite_\&_lite\+_firmware | No range specified | — |
| idemia sigma_wide_firmware | No range specified | — |
| idemia sigma_extreme_firmware | No range specified | — |
| idemia morphowave_compact_firmware | No range specified | — |
| idemia morphowave_sp_firmware | No range specified | — |
| idemia visionpass_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.