CVE-2023-39481 - CVE House
Back to Database
Status published Medium CVE-2023-39481

Softing Secure Integration Server Interpretation Conflict Remote Code Execution Vulnerability

Vulnerability Description

Softing Secure Integration Server Interpretation Conflict Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Softing Secure Integration Server. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the web server. The issue results from an inconsistency in URI parsing between NGINX and application code. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-20551.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-39481

Credits & Attribution

No credits recorded in the NVD database.

References

More from Softing

View All →
CVE-2025-7390
Bypass the client certificate trust check of an opc.https server while only secure communication is allowed
Critical 9.1
CVE-2025-13406
Scanning for higher HART revision device leads into NULL pointer dereference in live list
Medium 6.8
CVE-2025-10685
HTTP POST with specific higher content length leads into heap corruption
High 7.7
CVE-2025-10461
Global file reads caused by improper URL checks in webserver
Medium 5.3
CVE-2024-14028
Multiple implicit reads in parallel can result in a crash or denial of service
Medium 6.5

Affected Vendor

Affected Software

Secure Integration Server
Vulnerable Versions:
1.22.0.8686

Timeline

Official Publish: May 3rd, 2024
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-436

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.