1. Home
  2. CVE Database
  3. CVE-2023-4667
HIGH · 8.1

CVE-2023-4667

The web interface of the PAC Device allows the device administrator user profile to store malicious scripts in some fields. The stored malicious script is then executed when the GUI is opened by any ...

Vulnerability Description

The web interface of the PAC Device allows the device administrator user profile to store malicious scripts in some fields. The stored malicious script is then executed when the GUI is opened by any users of the webserver administration interface.  The root cause of the vulnerability is inadequate input validation and output encoding in the web administration interface component of the firmware. This could lead to  unauthorized access and data leakage

CVSS Score

8.1

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
NONE

Affected Products

VendorProductVersions
IdemiaSgima Lite \& Lite\+ FirmwareAll versions
IdemiaSgima Lite \& Lite\+-
IdemiaSigma Wide FirmwareAll versions
IdemiaSigma Wide-
IdemiaSigma Extreme FirmwareAll versions
IdemiaSigma Extreme-
IdemiaMorphowave Compact FirmwareAll versions
IdemiaMorphowave Compact-
IdemiaMorphowave Sp FirmwareAll versions
IdemiaMorphowave Sp-
IdemiaVisionpass FirmwareAll versions
IdemiaVisionpass-

Related Weaknesses (CWE)

CWE-79

References

FAQ

What is CVE-2023-4667?

CVE-2023-4667 is a vulnerability with a CVSS score of 8.1 (HIGH). The web interface of the PAC Device allows the device administrator user profile to store malicious scripts in some fields. The stored malicious script is then executed when the GUI is opened by any ...

How severe is CVE-2023-4667?

CVE-2023-4667 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-4667?

Check the references section above for vendor advisories and patch information. Affected products include: Idemia Sgima Lite \& Lite\+ Firmware, Idemia Sgima Lite \& Lite\+, Idemia Sigma Wide Firmware, Idemia Sigma Wide, Idemia Sigma Extreme Firmware.