{"cve":"CVE-2023-4667","nvd":{"published":"2023-11-28T09:15:07.467","modified":"2026-06-17T06:38:19.720","status":"Modified","description":"The web interface of the PAC Device allows the device administrator user profile to store malicious scripts in some fields. The stored malicious script is then executed when the GUI is opened by any users of the webserver administration interface. \n\n\n\nThe root cause of the vulnerability is inadequate input validation and output encoding in the web administration interface component of the firmware.\n\nThis could lead to  unauthorized access and data leakage","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","score":4.8},"cwes":["CWE-79"],"references":["https://www.idemia.com/vulnerability-information","https://www.idemia.com/vulnerability-information"],"products":["idemia:morphowave_compact_firmware","idemia:morphowave_sp_firmware","idemia:sgima_lite_\\&_lite\\+_firmware","idemia:sigma_extreme_firmware","idemia:sigma_wide_firmware","idemia:visionpass_firmware"],"source":"nvd","synced_at":"2026-10-19T21:42:07.670898610+00:00"},"epss":{"cve":"CVE-2023-4667","score":0.00421,"percentile":0.36432,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}