CVE-2023-39478 - CVE House
Back to Database
Status published Medium CVE-2023-39478

Softing Secure Integration Server Exposure of Resource to Wrong Sphere Remote Code Execution Vulnerability

Vulnerability Description

Softing Secure Integration Server Exposure of Resource to Wrong Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Softing Secure Integration Server. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling of OPC FileDirectory namespaces. The issue results from the lack of proper validation of user-supplied data before using it to create a server object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-20547.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-39478

Credits & Attribution

No credits recorded in the NVD database.

References

More from Softing

View All →
CVE-2025-7390
Bypass the client certificate trust check of an opc.https server while only secure communication is allowed
Critical 9.1
CVE-2025-13406
Scanning for higher HART revision device leads into NULL pointer dereference in live list
Medium 6.8
CVE-2025-10685
HTTP POST with specific higher content length leads into heap corruption
High 7.7
CVE-2025-10461
Global file reads caused by improper URL checks in webserver
Medium 5.3
CVE-2024-14028
Multiple implicit reads in parallel can result in a crash or denial of service
Medium 6.5

Affected Vendor

Affected Software

Secure Integration Server
Vulnerable Versions:
1.22.0.8686

Timeline

Official Publish: May 3rd, 2024
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-668

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1078 Valid Accounts
Persistence