{"cve":"CVE-2023-2621","nvd":{"published":"2023-11-01T03:15:07.790","modified":"2026-06-17T05:53:01.860","status":"Modified","description":"The McFeeder server (distributed as part of SSW package), is susceptible to an arbitrary file write vulnerability on the MAIN computer\nsystem. This vulnerability stems from the use of an outdated version of a third-party library, which is used to extract archives uploaded to McFeeder server. An authenticated malicious client can\nexploit this vulnerability by uploading a crafted ZIP archive via the\nnetwork to McFeeder’s service endpoint.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","score":6.5},"cwes":["CWE-22"],"references":["https://publisher.hitachienergy.com/preview?DocumentId=8DBD000177&languageCode=en&Preview=true","https://publisher.hitachienergy.com/preview?DocumentId=8DBD000177&languageCode=en&Preview=true"],"products":["hitachienergy:modular_advanced_control_for_hvdc"],"source":"nvd","synced_at":"2026-10-19T21:40:11.519948003+00:00"},"epss":{"cve":"CVE-2023-2621","score":0.00486,"percentile":0.41865,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}