CVE-2023-4667

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The web interface of the PAC Device allows the device administrator user profile to store malicious scripts in some fields. The stored malicious script is then executed when the GUI is opened by any users of the webserver administration interface.

The root cause of the vulnerability is inadequate input validation and output encoding in the web administration interface component of the firmware.

This could lead to unauthorized access and data leakage

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
IDEMIA	SIGMA Lite & Lite +	0
IDEMIA	SIGMA Wide	0
IDEMIA	SIGMA Extreme	0
IDEMIA	MorphoWave Compact/XP	0
IDEMIA	VisionPass	0
IDEMIA	MorphoWave SP	0
idemia	visionpass	0

References

https://www.idemia.com/vulnerability-informationVendor Advisory
https://www.idemia.com/vulnerability-informationVendor Advisory

Timeline

Published: Nov 28, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-466716.5An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error. Elastic has releas CVE-2023-466725.5An issue was identified by Elastic whereby sensitive information is recorded in Logstash logs under specific circumstances. The prerequisit CVE-2023-466737.5It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when CVE-2023-466747.8An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration properties that could hav CVE-2023-466756.5An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error or in the event whe CVE-2023-466779.8Online Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'txt_uname' parameter of the sign-up.php CVE-2023-466799.8Online Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'txt_uname_email' parameter of the index CVE-2023-46687.5The Ad Inserter for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.30 via the ai-debug-proc CVE-2023-466817.8Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in VR-S1000 firmware Ver. 2.37 and earlier CVE-2023-466837.2A post authentication command injection vulnerability exists when configuring the wireguard VPN functionality of Tp-Link ER7206 Omada Gigab CVE-2023-466859.8A hard-coded password vulnerability exists in the telnetd functionality of LevelOne WBR-6013 RER4_A_v3411b_2T2R_LEV_09_170623. A set of spec CVE-2023-466867.1A reliance on untrusted inputs in a security decision could be exploited by a privileged user to configure the Gallagher Command Centre Diag