CVE-2023-33367

9.8 criticalEPSS 1.1%

Critical (9.8) in assaabloy control id idsecure. EPSS 1.1% chance of exploitation in the next 30 days.

A SQL injection vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing unauthenticated attackers to write PHP files on the server's root directory, resulting in remote code execution.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.1% chance of exploitation in the next 30 days; higher than 65% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2023-08-05
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

assaabloy:control_id_idsecure

References

https://claroty.com/team82/disclosure-dashboard/cve-2023-33367
https://www.controlid.com.br/en/access-control/idsecure/
https://claroty.com/team82/disclosure-dashboard/cve-2023-33367
https://www.controlid.com.br/en/access-control/idsecure/

Check your stack JSON