SQL injection in Genians Genian NAC V4.0
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection, Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89 and CWE-494.
Summary
Download of Code Without Integrity Check vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian NAC Suite V5.0, Genians Genian ZTNA allows Malicious Software Update.This issue affects Genian NAC V4.0: from V4.0.0 through V4.0.155; Genian NAC V5.0: from V5.0.0 through V5.0.42 (Revision 117460); Genian NAC Suite V5.0: from V5.0.0 through V5.0.54; Genian ZTNA: from V6.0.0 through V6.0.15.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Genians | Genian NAC V4.0 | V4.0.0 – V4.0.155 | — | No fix listed | CNA |
| Genians | Genian NAC V5.0 | V5.0.0 – V5.0.42 (Revision 117460) | — | No fix listed | CNA |
| Genians | Genian NAC Suite V5.0 | V5.0.0 – V5.0.54 | — | No fix listed | CNA |
| Genians | Genian ZTNA | V6.0.0 – V6.0.15 | — | No fix listed | CNA |
- Genian NAC V4.0 VendorGenians Affected V4.0.0 – V4.0.155 Fixed in — No fix listed CNA
- Genian NAC V5.0 VendorGenians Affected V5.0.0 – V5.0.42 (Revision 117460) Fixed in — No fix listed CNA
- Genian NAC Suite V5.0 VendorGenians Affected V5.0.0 – V5.0.54 Fixed in — No fix listed CNA
- Genian ZTNA VendorGenians Affected V6.0.0 – V6.0.15 Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:genians:genian_nac:*:*:*:*:-:*:*:* | 4.0.0 to before 4.0.156; 5.0.0 to before 5.0.55 | Vulnerable | Genians |
| cpe:2.3:a:genians:genian_nac:5.0.42:-:*:*:lts:*:*:* | 5.0.42 | Vulnerable | Genians |
| cpe:2.3:a:genians:genian_nac:5.0.42:revision_117460:*:*:lts:*:*:* | 5.0.42 revision_117460 | Vulnerable | Genians |
| cpe:2.3:a:genians:genian_ztna:*:*:*:*:*:*:*:* | 6.0.0 to before 6.0.16 | Vulnerable | Genians |
- cpe:2.3:a:genians:genian_nac:*:*:*:*:-:*:*:* Versions 4.0.0 to before 4.0.156; 5.0.0 to before 5.0.55 Vulnerable ·Genians
- cpe:2.3:a:genians:genian_nac:5.0.42:-:*:*:lts:*:*:* Versions 5.0.42 Vulnerable ·Genians
- cpe:2.3:a:genians:genian_nac:5.0.42:revision_117460:*:*:lts:*:*:* Versions 5.0.42 revision_117460 Vulnerable ·Genians
- cpe:2.3:a:genians:genian_ztna:*:*:*:*:*:*:*:* Versions 6.0.0 to before 6.0.16 Vulnerable ·Genians
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-40254
- 2026-10-03 Alias added: GHSA-vxfw-7phg-r3vf
More Genians Genian Nac vulnerabilities
- TI-2021-08340 Genian NAC remote code execution vulnerability CVSS 3.1CRITICAL 10.0
- TI-2023-21102 OS command injection in Genians Genian NAC V4.0 CVSS 3.1CRITICAL 9.8
- TI-2023-21101 Code injection in Genians Genian NAC V4.0 CVSS 3.1CRITICAL 9.8
- TI-2023-21100 Missing Encryption of Sensitive Data vulnerability in Genians Genian NAC V4.0, Genians… CVSS 3.1MEDIUM 5.9
Sources
- CVE-2023-40254 · CVE Program
- CVE-2023-40254 · NVD
- FIRST EPSS
- GHSA-vxfw-7phg-r3vf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences