Skip to main content

Modulys Gp Firmware CVE-2023-39452

HIGH
Plaintext Storage of a Password (CWE-256)
2023-09-18 ics-cert@hq.dhs.gov
Information Disclosure Modulys Gp Firmware
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Sep 18, 2023 - 21:16 nvd
HIGH 7.5

DescriptionNVD

The web application that owns the device clearly stores the credentials within the user management section. Obtaining this information can be done remotely due to the incorrect management of the sessions in the web application.

AnalysisAI

The web application that owns the device clearly stores the credentials within the user management section. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-256. The web application that owns the device clearly stores the credentials within the user management section. Obtaining this information can be done remotely due to the incorrect management of the sessions in the web application. Affected products include: Socomec Modulys Gp Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Modulys Gp Firmware

View all
CVE-2023-41084 CRITICAL
9.8 Sep 18

Session management within the web application is incorrect and allows attackers to steal session cookies to perform a mu
CVE-2023-39446 HIGH
8.8 Sep 18

Thanks to the weaknesses that the web application has at the user management level, an attacker could obtain the informa
CVE-2023-40221 HIGH
8.8 Sep 18

The absence of filters when loading some sections in the web application of the vulnerable device allows potential attac
CVE-2023-41965 HIGH
7.5 Sep 18

Sending some requests in the web application of the vulnerable device allows information to be obtained due to the lack

CVE-2023-38255 MEDIUM
6.1 Sep 18

A potential attacker with or without (cookie theft) access to the device would be able to include malicious code (XSS) w
CVE-2023-38582 MEDIUM
5.4 Sep 18

Persistent cross-site scripting (XSS) in the web application of MOD3GP-SY-120K allows an authenticated remote attacker t

Same weakness CWE-256 – Plaintext Storage of a Password

View all
CVE-2024-33375 CRITICAL POC
9.8
CVE-2018-25396 HIGH POC
8.7
CVE-2024-49370 HIGH POC
8.7
CVE-2024-40116 HIGH POC
8.1
CVE-2020-8183 HIGH POC
7.5
CVE-2019-10921 HIGH POC
7.5
CVE-2024-9418 MEDIUM POC
6.5
CVE-2020-37115 MEDIUM POC
6.5

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2023-39452 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy