CVE-2023-4667

Name: CVE-2023-4667
Creator: NVD / NIST
Published: 2023-11-28T09:15:07.467+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 4.8/10EPSS 0.42%

Last modified Jun 17, 2026

CVE-2023-4667 is a medium-severity vulnerability rated 4.8/10 on the CVSS scale. The web interface of the PAC Device allows the device administrator user profile to store malicious scripts in some fields. The stored malicious script is then executed when the GUI is opened by any users of the webserver administration interface. The root cause of the vulnerability is inadequate input validation and output encoding in the web administration interface component of the firmware. This could lead to unauthorized access and data leakage . EPSS estimates a 0.42% chance of exploitation in the next 30 days.

Description

The web interface of the PAC Device allows the device administrator user profile to store malicious scripts in some fields. The stored malicious script is then executed when the GUI is opened by any users of the webserver administration interface. The root cause of the vulnerability is inadequate input validation and output encoding in the web administration interface component of the firmware. This could lead to unauthorized access and data leakage

Metrics

CVSS 3.1

4.8/10

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS Probability

0.42%

33.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Idemia	Sgima Lite \& Lite\+ Firmware	All versions
Idemia	Sigma Wide Firmware	All versions
Idemia	Sigma Extreme Firmware	All versions
Idemia	Morphowave Compact Firmware	All versions
Idemia	Morphowave Sp Firmware	All versions
Idemia	Visionpass Firmware	All versions

References

https://www.idemia.com/vulnerability-informationVendor Advisory
https://www.idemia.com/vulnerability-informationVendor Advisory

Timeline

Published: Nov 28, 2023
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2023-4667?

How severe is CVE-2023-4667?

CVE-2023-4667 has a CVSS score of 4.8/10 (MEDIUM severity). The EPSS model estimates a 0.42% probability of exploitation in the next 30 days.

How do I fix CVE-2023-4667?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2023-4667?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST