Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2023-4667 Details

Description

The web interface of the PAC Device allows the device administrator user profile to store malicious scripts in some fields. The stored malicious script is then executed when the GUI is opened by any users of the webserver administration interface. The root cause of the vulnerability is inadequate input validation and output encoding in the web administration interface component of the firmware. This could lead to unauthorized access and data leakage

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:4.8 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

CNA: IDEMIACVSS-B:8.1 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://www.idemia.com/vulnerability-information	IDEMIA	Vendor Advisory
https://www.idemia.com/vulnerability-information	CVE	Vendor Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-79	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	[email protected]
CWE-79	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	IDEMIA

Affected Products

Product	Versions
idemia sgima lite & lite+ firmware	All versions
CPE cpe:2.3:o:idemia:sgima_lite_&_lite+_firmware:::::::: Remediation No remediation found in references.
idemia sgima lite & lite+	All versions
CPE cpe:2.3:h:idemia:sgima_lite_&_lite+:-:::::::* Remediation No remediation found in references.
idemia sigma wide firmware	All versions
CPE cpe:2.3:o:idemia:sigma_wide_firmware:::::::: Remediation No remediation found in references.
idemia sigma wide	All versions
CPE cpe:2.3:h:idemia:sigma_wide:-:::::::* Remediation No remediation found in references.
idemia sigma extreme firmware	All versions
CPE cpe:2.3:o:idemia:sigma_extreme_firmware:::::::: Remediation No remediation found in references.
idemia sigma extreme	All versions
CPE cpe:2.3:h:idemia:sigma_extreme:-:::::::* Remediation No remediation found in references.
idemia morphowave compact firmware	All versions
CPE cpe:2.3:o:idemia:morphowave_compact_firmware:::::::: Remediation No remediation found in references.
idemia morphowave compact	All versions
CPE cpe:2.3:h:idemia:morphowave_compact:-:::::::* Remediation No remediation found in references.
idemia morphowave sp firmware	All versions
CPE cpe:2.3:o:idemia:morphowave_sp_firmware:::::::: Remediation No remediation found in references.
idemia morphowave sp	All versions
CPE cpe:2.3:h:idemia:morphowave_sp:-:::::::* Remediation No remediation found in references.
idemia visionpass firmware	All versions
CPE cpe:2.3:o:idemia:visionpass_firmware:::::::: Remediation No remediation found in references.
idemia visionpass	All versions
CPE cpe:2.3:h:idemia:visionpass:-:::::::* Remediation No remediation found in references.

Change History

6 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	IDEMIA
Jun 17, 2026	CVE Modified	CISA-ADP
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	IDEMIA
Dec 5, 2023	Initial Analysis	[email protected]
Nov 28, 2023	New CVE Received	IDEMIA

CVE-2023-4667 Details

Description

Metrics

References to Advisories, Solutions, and Tools

Weakness Enumeration

Affected Products

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

Change History

QUICK INFO