Stored Cross Site Scripting in webserver administration
Priority LOW 38CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
The web interface of the PAC Device allows the device administrator user profile to store malicious scripts in some fields. The stored malicious script is then executed when the GUI is opened by any users of the webserver administration interface. The root cause of the vulnerability is inadequate input validation and output encoding in the web administration interface component of the firmware. This could lead to unauthorized access and data leakage
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00421 36th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| IDEMIA | SIGMA Lite & Lite + | all versions | — | No fix listed | CNA |
| IDEMIA | SIGMA Wide | all versions | — | No fix listed | CNA |
| IDEMIA | SIGMA Extreme | all versions | — | No fix listed | CNA |
| IDEMIA | MorphoWave Compact/XP | all versions | — | No fix listed | CNA |
| IDEMIA | VisionPass | all versions | — | No fix listed | CNA |
| IDEMIA | MorphoWave SP | all versions | — | No fix listed | CNA |
- SIGMA Lite & Lite + VendorIDEMIA Affected all versions Fixed in — No fix listed CNA
- SIGMA Wide VendorIDEMIA Affected all versions Fixed in — No fix listed CNA
- SIGMA Extreme VendorIDEMIA Affected all versions Fixed in — No fix listed CNA
- MorphoWave Compact/XP VendorIDEMIA Affected all versions Fixed in — No fix listed CNA
- VisionPass VendorIDEMIA Affected all versions Fixed in — No fix listed CNA
- MorphoWave SP VendorIDEMIA Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 12
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:idemia:sgima_lite_\&_lite\+_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | IDEMIA |
| cpe:2.3:h:idemia:sgima_lite_\&_lite\+:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IDEMIA |
| cpe:2.3:o:idemia:sigma_wide_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | IDEMIA |
| cpe:2.3:h:idemia:sigma_wide:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IDEMIA |
| cpe:2.3:o:idemia:sigma_extreme_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | IDEMIA |
| cpe:2.3:h:idemia:sigma_extreme:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IDEMIA |
| cpe:2.3:o:idemia:morphowave_compact_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | IDEMIA |
| cpe:2.3:h:idemia:morphowave_compact:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IDEMIA |
| cpe:2.3:o:idemia:morphowave_sp_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | IDEMIA |
| cpe:2.3:h:idemia:morphowave_sp:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IDEMIA |
- cpe:2.3:o:idemia:sgima_lite_\&_lite\+_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·IDEMIA
- cpe:2.3:h:idemia:sgima_lite_\&_lite\+:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IDEMIA
- cpe:2.3:o:idemia:sigma_wide_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·IDEMIA
- cpe:2.3:h:idemia:sigma_wide:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IDEMIA
- cpe:2.3:o:idemia:sigma_extreme_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·IDEMIA
- cpe:2.3:h:idemia:sigma_extreme:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IDEMIA
- cpe:2.3:o:idemia:morphowave_compact_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·IDEMIA
- cpe:2.3:h:idemia:morphowave_compact:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IDEMIA
- cpe:2.3:o:idemia:morphowave_sp_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·IDEMIA
- cpe:2.3:h:idemia:morphowave_sp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IDEMIA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-4667
- 2026-10-03 Alias added: GHSA-5585-c8pm-rcfv
References
More IDEMIA Morphowave Compact Firmware vulnerabilities
- TI-2023-16398 Stack buffer overflow when reading DESFire card CVSS 3.1CRITICAL 9.8
- TI-2023-16397 Heap Buffer Overflow when reading DESFire card CVSS 3.1CRITICAL 9.8
- TI-2023-16396 Stack Buffer Overflow when checking some attributes during retrofit CVSS 3.1CRITICAL 9.8
- TI-2023-16395 Stack Buffer Overflow when checking retrofit package CVSS 3.1CRITICAL 9.8
- TI-2023-16394 Stack Buffer Overflow in a binary run at upgrade startup CVSS 3.1CRITICAL 9.8
- TI-2023-16393 Missing integrity check on upgrade package CVSS 3.1HIGH 7.5
Sources
- CVE-2023-4667 · CVE Program
- CVE-2023-4667 · NVD
- FIRST EPSS
- GHSA-5585-c8pm-rcfv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences