CVE-2023-38255

2023-09-1821:15:53

CWE-79

[email protected]

web.nvd.nist.gov

potential attacker

xss code

device configuration

cookie theft

device function

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.7

Confidence

High

EPSS

0.001

Percentile

28.0%

JSON

A potential attacker with or without (cookie theft) access to the device would be able to include malicious code (XSS) when uploading new device configuration that could affect the intended function of the device.

Affected configurations

Nvd

Node

socomecmodulys_gp_firmwareMatch01.12.10

AND

socomecmodulys_gpMatch-

VendorProductVersionCPE
socomecmodulys_gp_firmware01.12.10cpe:2.3:o:socomec:modulys_gp_firmware:01.12.10:*:*:*:*:*:*:*
socomecmodulys_gp-cpe:2.3:h:socomec:modulys_gp:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
socomec	modulys_gp_firmware	01.12.10	cpe:2.3:o:socomec:modulys_gp_firmware:01.12.10:::::::*
socomec	modulys_gp	-	cpe:2.3:h:socomec:modulys_gp:-:::::::*