CVE-2023-40221

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The absence of filters when loading some sections in the web application of the vulnerable device allows potential attackers to inject malicious code that will be interpreted when a legitimate user accesses the web section (MAIL SERVER) where the information is displayed. Injection can be done on parameter MAIL_RCV. When a legitimate user attempts to review NOTIFICATION/MAIL SERVER, the injected code will be executed.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
Socomec	MODULYS GP (MOD3GP-SY-120K)	v01.12.10
socomec	modulys_gp_firmware	01.12.10

References

https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-03Third Party Advisory, US Government Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-03Third Party Advisory, US Government Resource

Timeline

Published: Sep 18, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-402227.8In Ashlar-Vellum Cobalt versions prior to v12 SP2 Build (1204.200), the affected application lacks proper validation of user-supplied data w CVE-2023-402246.1MISP 2.4.174 allows XSS in app/View/Events/index.ctp.CVE-2023-402257.2HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, CVE-2023-40234.3The All Users Messenger WordPress plugin through 1.24 does not prevent non-administrator users from deleting messages from the all-users mes CVE-2023-402356.5An NTLM Hash Disclosure was discovered in ArchiMate Archi before 5.1.0. When parsing the XMLNS value of an ArchiMate project file, if the na CVE-2023-402365.3In Pexip VMR self-service portal before 3, the same SSH host key is used across different customers' installations, which allows authenticat CVE-2023-402385.5A LogoFAIL issue was discovered in BmpDecoderDxe in Insyde InsydeH2O with kernel 5.2 before 05.28.47, 5.3 before 05.37.47, 5.4 before 05.45.CVE-2023-402397.5Certain Lexmark devices (such as CS310) before 2023-08-25 allow XXE attacks, leading to information disclosure. The fixed firmware version i CVE-2023-40245.3The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_pla CVE-2023-40255.3The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_pla CVE-2023-402508.8Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Hancom HCell on Windows allows Overflow Buffers.This CVE-2023-402515.9Missing Encryption of Sensitive Data vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian NAC Suite V5.0, Genia