CVE-2023-4667

published 2023-11-28

CVE-2023-4667: The web interface of the PAC Device allows the device administrator user profile to store malicious scripts in some fields. The stored malicious script is then…

Priority P4 23 medium 4.8 CVSS 3.1

AV N AC L PR H UI R S C C L I L A N

The web interface of the PAC Device allows the device administrator user profile to store malicious scripts in some fields. The stored malicious script is then executed when the GUI is opened by any users of the webserver administration interface.

The root cause of the vulnerability is inadequate input validation and output encoding in the web administration interface component of the firmware.

This could lead to unauthorized access and data leakage

Affected

6 ranges

Vendor	Product	Version range	Fixed in
idemia	morphowave_compact_xp	—	—
idemia	morphowave_sp	—	—
idemia	sigma_extreme	—	—
idemia	sigma_lite_lite	—	—
idemia	sigma_wide	—	—
idemia	visionpass	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79