Paper/Archive/CVE-2023-40252

CVE-2023-40252

Genians Genian NAC V4.0 — Improper Control of Generation of Code ('Code Injection') vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Geni…

EPSS 0.4%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 34.4.344 × 206.9 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Improper Control of Generation of Code ('Code Injection') vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian NAC Suite V5.0, Genians Genian ZTNA allows Replace Trusted Executable.This issue affects Genian NAC V4.0: from V4.0.0 through V4.0.155; Genian NAC V5.0: from V5.0.0 through V5.0.42 (Revision 117460); Genian NAC Suite V5.0: from V5.0.0 through V5.0.54; Genian ZTNA: from V6.0.0 through V6.0.15.

Affected

ProductAffectedFixed inSource

Genian NAC V4.0V4.0.0 – V4.0.155–CNA

Genian NAC V5.0V5.0.0 – V5.0.42 (Revision 117460)–CNA

Genian NAC Suite V5.0V5.0.0 – V5.0.54–CNA

Genian ZTNAV6.0.0 – V6.0.15–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

krcert (CNA)6.0CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refdocs.genians.com/nac/5.0/release/ko/advisories/GN-SA-2023-001.html