Code injection in Genians Genian NAC V4.0
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-94.
Summary
Improper Control of Generation of Code ('Code Injection') vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian NAC Suite V5.0, Genians Genian ZTNA allows Replace Trusted Executable.This issue affects Genian NAC V4.0: from V4.0.0 through V4.0.155; Genian NAC V5.0: from V5.0.0 through V5.0.42 (Revision 117460); Genian NAC Suite V5.0: from V5.0.0 through V5.0.54; Genian ZTNA: from V6.0.0 through V6.0.15.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Genians | Genian NAC V4.0 | V4.0.0 – V4.0.155 | — | No fix listed | CNA |
| Genians | Genian NAC V5.0 | V5.0.0 – V5.0.42 (Revision 117460) | — | No fix listed | CNA |
| Genians | Genian NAC Suite V5.0 | V5.0.0 – V5.0.54 | — | No fix listed | CNA |
| Genians | Genian ZTNA | V6.0.0 – V6.0.15 | — | No fix listed | CNA |
- Genian NAC V4.0 VendorGenians Affected V4.0.0 – V4.0.155 Fixed in — No fix listed CNA
- Genian NAC V5.0 VendorGenians Affected V5.0.0 – V5.0.42 (Revision 117460) Fixed in — No fix listed CNA
- Genian NAC Suite V5.0 VendorGenians Affected V5.0.0 – V5.0.54 Fixed in — No fix listed CNA
- Genian ZTNA VendorGenians Affected V6.0.0 – V6.0.15 Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:genians:genian_nac:*:*:*:*:-:*:*:* | 4.0.0 to before 4.0.156; 5.0.0 to before 5.0.55 | Vulnerable | Genians |
| cpe:2.3:a:genians:genian_nac:5.0.42:-:*:*:lts:*:*:* | 5.0.42 | Vulnerable | Genians |
| cpe:2.3:a:genians:genian_nac:5.0.42:revision_117460:*:*:lts:*:*:* | 5.0.42 revision_117460 | Vulnerable | Genians |
| cpe:2.3:a:genians:genian_ztna:*:*:*:*:*:*:*:* | 6.0.0 to before 6.0.16 | Vulnerable | Genians |
- cpe:2.3:a:genians:genian_nac:*:*:*:*:-:*:*:* Versions 4.0.0 to before 4.0.156; 5.0.0 to before 5.0.55 Vulnerable ·Genians
- cpe:2.3:a:genians:genian_nac:5.0.42:-:*:*:lts:*:*:* Versions 5.0.42 Vulnerable ·Genians
- cpe:2.3:a:genians:genian_nac:5.0.42:revision_117460:*:*:lts:*:*:* Versions 5.0.42 revision_117460 Vulnerable ·Genians
- cpe:2.3:a:genians:genian_ztna:*:*:*:*:*:*:*:* Versions 6.0.0 to before 6.0.16 Vulnerable ·Genians
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-40252
- 2026-10-03 Alias added: GHSA-fwcj-54q6-qwrm
More Genians Genian Nac vulnerabilities
- TI-2023-21103 SQL injection in Genians Genian NAC V4.0 CVSS 3.1CRITICAL 9.8
- TI-2021-08340 Genian NAC remote code execution vulnerability CVSS 3.1CRITICAL 10.0
- TI-2023-21102 OS command injection in Genians Genian NAC V4.0 CVSS 3.1CRITICAL 9.8
- TI-2023-21100 Missing Encryption of Sensitive Data vulnerability in Genians Genian NAC V4.0, Genians… CVSS 3.1MEDIUM 5.9
Sources
- CVE-2023-40252 · CVE Program
- CVE-2023-40252 · NVD
- FIRST EPSS
- GHSA-fwcj-54q6-qwrm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences