CVE-2023-40254

State: Published
Severity: 7.5 High
Published: Aug 11, 2023
Updated: Oct 10, 2024
Reserved: Aug 11, 2023

Description

Download of Code Without Integrity Check vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian NAC Suite V5.0, Genians Genian ZTNA allows Malicious Software Update.This issue affects Genian NAC V4.0: from V4.0.0 through V4.0.155; Genian NAC V5.0: from V5.0.0 through V5.0.42 (Revision 117460); Genian NAC Suite V5.0: from V5.0.0 through V5.0.54; Genian ZTNA: from V6.0.0 through V6.0.15.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H	krcert

Weaknesses

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

Product	Versions
Genian NAC V4.0Genians	V4.0.0 through V4.0.155Affectedfrom V4.0.156Not affected
Genian NAC V5.0Genians	V5.0.0 through V5.0.42 (Revision 117460)Affectedfrom V5.0.42 (Revision 117461)Not affected
Genian NAC Suite V5.0Genians	V5.0.0 through V5.0.54Affectedfrom V5.0.55Not affected
Genian ZTNAGenians	V6.0.0 through V6.0.15Affectedfrom V6.0.16Not affected

References

https://docs.genians.com/nac/5.0/release/ko/advisories/GN-SA-2023-001.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.