CVE-2023-38255

CVE-2023-38255 is an XSS vulnerability in the web interface of Socomec MODULYS GP (MOD3GP-SY-120K) with web firmware v01.12.10. The issue arises from improper handling during web page generation and input in the MAIL_RCV/notifications area, allowing an attacker to inject JavaScript when a legitim...

CVE-2023-38582

MOD3GP-SY-120K (MODULYS GP) web firmware v01.12.10 is affected by a persistent cross-site scripting (XSS) flaw in the MAIL_RCV field that allows an authenticated remote attacker to inject arbitrary JavaScript, executed when a user loads the vulnerable page. Affected product is the MOD3GP-SY-120K ...

CVE-2023-39446

The CVE-2023-39446 CSRF issue affects the Socomec MODULYS GP family web firmware (MOD3GP-SY-120K). Root cause: weaknesses in the web app’s user management allow an attacker to obtain header information to craft specially designed URLs and trigger actions when a legitimate user is logged in. Impac...

CVE-2023-40221

CVE-2023-40221 is a code-injection vulnerability in Socomec MODULYS GP MOD3GP-SY-120K web firmware (affected version: v01.12.10). The issue arises from lack of input filtering in the web app, allowing an attacker to inject code via the MAIL_RCV parameter and have it executed when a legitimate use...

CVE-2023-41084

Summary: CVE-2023-41084 is a high-severity vulnerability in Socomec MODULYS GP web interface (MOD3GP-SY-120K) caused by incorrect session management that can allow an attacker to steal session cookies and perform actions on the device. Public sources describe a web-only vector with remote exposur...

CVE-2023-39452

CVE-2023-39452 affects Socomec MODULYS GP (MOD3GP-SY-120K) web interface. Public documents identify plaintext storage of passwords in the user management section and remote credential exposure due to improper session handling. Affected product details cited by CISA ICS advisory (MODULYS GP-SY-120...

CVE-2023-41965

CVE-2023-41965 affects Socomec MODULYS GP (MOD3GP-SY-120K) Web firmware v01.12.10. The issue is insecure storage of sensitive information due to lack of authentication security, enabling information disclosure via web requests. Public exploitation details are not provided in the documents. PT-202...