Vulnerability · Published Sep 18, 2023 · Assigned by icscert

CVE-2023-40221Socomec MOD3GP-SY-120K Code Injection

High 8.8

In plain English

A high-severity code injection in MODULYS GP (MOD3GP-SY-120K) from Socomec. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.6%top 48.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The absence of filters when loading some sections in the web application of the vulnerable device allows potential attackers to inject malicious code that will be interpreted when a legitimate user accesses the web section (MAIL SERVER) where the information is displayed. Injection can be done on parameter MAIL_RCV. When a legitimate user attempts to review NOTIFICATION/MAIL SERVER, the injected code will be executed.

Affected products (as reported)

Vendor	Product	Versions
Socomec	MODULYS GP (MOD3GP-SY-120K)	v01.12.10

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-03