Skip to content
OpenAdvisories
Critical ICSA-23-040-01 2 CVEs

Control By Web X-400, X-600M

Published Feb 9, 2023 · Updated Feb 9, 2023

Vendor: Control By Web Product: X-400 Product: X-600M

Summary

Successful exploitation of these vulnerabilities could allow an attacker to inject malicious JavaScript and execute arbitrary code remotely, which could result in a loss of sensitive information.

Vulnerabilities 2

  • Critical 9.1
    CVE-2023-23551

    X-600M Code Injection

    Control By Web X-600M devices run Lua scripts and are vulnerable to code injection, which could allow an attacker to remotely execute arbitrary code.

    Control By Web X-600M devices
  • Medium 4.5
    CVE-2023-23553

    X-400 Cross-Site Scripting

    Control By Web X-400 devices are vulnerable to a cross-site scripting attack, which could result in private and session information being transferred to the attacker.

    Control By Web X-400 devices

Revision history

  1. #1

    Publication Date

References