CVE-2023-27335 - CVE House
Back to Database
Status published High CVE-2023-27335

Softing edgeAggregator Client Cross-Site Scripting Remote Code Execution Vulnerability

Vulnerability Description

Softing edgeAggregator Client Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Softing edgeAggregator. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the input parameters provided to the edgeAggregetor client. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-20504.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-27335

Credits & Attribution

No credits recorded in the NVD database.

References

More from Softing

View All →
CVE-2025-7390
Bypass the client certificate trust check of an opc.https server while only secure communication is allowed
Critical 9.1
CVE-2025-13406
Scanning for higher HART revision device leads into NULL pointer dereference in live list
Medium 6.8
CVE-2025-10685
HTTP POST with specific higher content length leads into heap corruption
High 7.7
CVE-2025-10461
Global file reads caused by improper URL checks in webserver
Medium 5.3
CVE-2024-14028
Multiple implicit reads in parallel can result in a crash or denial of service
Medium 6.5

Affected Vendor

Affected Software

edgeAggregator
Vulnerable Versions:
3.40

Timeline

Official Publish: May 3rd, 2024
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-79

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact