CVE-2023-40221

Description

The absence of filters when loading some sections in the web application of the vulnerable device allows potential attackers to inject malicious code that will be interpreted when a legitimate user accesses the web section (MAIL SERVER) where the information is displayed. Injection can be done on parameter MAIL_RCV. When a legitimate user attempts to review NOTIFICATION/MAIL SERVER, the injected code will be executed.

Reserved 2023-09-06 | Published 2023-09-18 | Updated 2024-08-02 | Assigner icscert

Problem types

CWE-94 Code Injection

Product status

Default status
unaffected

v01.12.10
affected

Credits

Aarón Flecha Menéndez reported these vulnerabilities to CISA. finder

References

www.cisa.gov/news-events/ics-advisories/icsa-23-250-03

cve.org (CVE-2023-40221)

nvd.nist.gov (CVE-2023-40221)

Download JSON