OS command injection in Genians Genian NAC V4.0
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution, Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78 and CWE-287.
Summary
Improper Authentication vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian NAC Suite V5.0, Genians Genian ZTNA allows Authentication Abuse.This issue affects Genian NAC V4.0: from V4.0.0 through V4.0.155; Genian NAC V5.0: from V5.0.0 through V5.0.42 (Revision 117460); Genian NAC Suite V5.0: from V5.0.0 through V5.0.54; Genian ZTNA: from V6.0.0 through V6.0.15.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Genians | Genian NAC V4.0 | V4.0.0 – V4.0.155 | — | No fix listed | CNA |
| Genians | Genian NAC V5.0 | V5.0.0 – V5.0.42 (Revision 117460) | — | No fix listed | CNA |
| Genians | Genian NAC Suite V5.0 | V5.0.0 – V5.0.54 | — | No fix listed | CNA |
| Genians | Genian ZTNA | V6.0.0 – V6.0.15 | — | No fix listed | CNA |
- Genian NAC V4.0 VendorGenians Affected V4.0.0 – V4.0.155 Fixed in — No fix listed CNA
- Genian NAC V5.0 VendorGenians Affected V5.0.0 – V5.0.42 (Revision 117460) Fixed in — No fix listed CNA
- Genian NAC Suite V5.0 VendorGenians Affected V5.0.0 – V5.0.54 Fixed in — No fix listed CNA
- Genian ZTNA VendorGenians Affected V6.0.0 – V6.0.15 Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:genians:genian_nac:*:*:*:*:-:*:*:* | 4.0.0 to before 4.0.156; 5.0.0 to before 5.0.55 | Vulnerable | Genians |
| cpe:2.3:a:genians:genian_nac:5.0.42:-:*:*:lts:*:*:* | 5.0.42 | Vulnerable | Genians |
| cpe:2.3:a:genians:genian_nac:5.0.42:revision_117460:*:*:lts:*:*:* | 5.0.42 revision_117460 | Vulnerable | Genians |
| cpe:2.3:a:genians:genian_ztna:*:*:*:*:*:*:*:* | 6.0.0 to before 6.0.16 | Vulnerable | Genians |
- cpe:2.3:a:genians:genian_nac:*:*:*:*:-:*:*:* Versions 4.0.0 to before 4.0.156; 5.0.0 to before 5.0.55 Vulnerable ·Genians
- cpe:2.3:a:genians:genian_nac:5.0.42:-:*:*:lts:*:*:* Versions 5.0.42 Vulnerable ·Genians
- cpe:2.3:a:genians:genian_nac:5.0.42:revision_117460:*:*:lts:*:*:* Versions 5.0.42 revision_117460 Vulnerable ·Genians
- cpe:2.3:a:genians:genian_ztna:*:*:*:*:*:*:*:* Versions 6.0.0 to before 6.0.16 Vulnerable ·Genians
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-40253
- 2026-10-03 Alias added: GHSA-vjw2-5fjm-hhr4
More Genians Genian Nac vulnerabilities
- TI-2023-21103 SQL injection in Genians Genian NAC V4.0 CVSS 3.1CRITICAL 9.8
- TI-2021-08340 Genian NAC remote code execution vulnerability CVSS 3.1CRITICAL 10.0
- TI-2023-21101 Code injection in Genians Genian NAC V4.0 CVSS 3.1CRITICAL 9.8
- TI-2023-21100 Missing Encryption of Sensitive Data vulnerability in Genians Genian NAC V4.0, Genians… CVSS 3.1MEDIUM 5.9
Sources
- CVE-2023-40253 · CVE Program
- CVE-2023-40253 · NVD
- FIRST EPSS
- GHSA-vjw2-5fjm-hhr4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences