CVE-2023-38125— Softing edgeAggregator Permissive Cross-domain Policy with Untrusted Domains Remote Code Execution Vulnerability
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2023-38125
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Softing edgeAggregator Permissive Cross-domain Policy with Untrusted Domains Remote Code Execution Vulnerability
Source: NVD (National Vulnerability Database)
Vulnerability Description
Softing edgeAggregator Permissive Cross-domain Policy with Untrusted Domains Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Softing edgeAggregator. Authentication is required to exploit this vulnerability. The specific flaw exists within the configuration of the web server. The issue results from the lack of appropriate Content Security Policy headers. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-20542.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
过度许可的跨域白名单
Source: NVD (National Vulnerability Database)
Vulnerability Title
Softing edgeAggregator 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Softing edgeAggregator是Softing的一个灵活且基于容器的解决方案，用于管理OT/IT集成到边缘和云应用的复杂系统架构。 Softing edgeAggregator 存在安全漏洞，该漏洞源于Web 服务器的配置中缺乏适当的内容安全策略标头，攻击者利用该漏洞可以在 root 上下文中执行代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Softing | edgeAggregator | 3.40 | - |
II. Public POCs for CVE-2023-38125
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-38125
请登录查看更多情报信息。
Same Patch Batch · Softing · 2024-05-03 · 9 CVEs total
| CVE-2023-39480 | Softing Secure Integration Server FileDirectory OPC UA Object Arbitrary File Creation Vuln | |
| CVE-2023-39481 | Softing Secure Integration Server Interpretation Conflict Remote Code Execution Vulnerabil | |
| CVE-2023-39482 | Softing Secure Integration Server Hardcoded Cryptographic Key Information Disclosure Vulne | |
| CVE-2023-39479 | Softing Secure Integration Server OPC UA Gateway Directory Creation Vulnerability | |
| CVE-2023-39478 | Softing Secure Integration Server Exposure of Resource to Wrong Sphere Remote Code Executi | |
| CVE-2023-27334 | Softing edgeConnector Siemens ConditionRefresh Resource Exhaustion Denial-of-Service Vulne | |
| CVE-2023-27336 | Softing edgeConnector Siemens OPC UA Server Null Pointer Dereference Denial-of-Service Vul | |
| CVE-2023-27335 | Softing edgeAggregator Client Cross-Site Scripting Remote Code Execution Vulnerability |
IV. Related Vulnerabilities
Same vendor: Softing
- CVE-2023-7339
Data collection for dowloading leads into buffer overflow - CVE-2024-14028
Multiple implicit reads in parallel can result in a crash or - CVE-2025-13406
Scanning for higher HART revision device leads into NULL poi - CVE-2025-10461
Global file reads caused by improper URL checks in webserver - CVE-2025-10685
HTTP POST with specific higher content length leads into hea
Same weakness: CWE-942
- CVE-2026-7643
ChatGPTNextWeb NextChat API Endpoint Next.js cross-domain po - CVE-2026-7581
alexta69 MeTube CORS Policy main.py on_prepare cross-domain - CVE-2026-41056
AVideos has CORS Origin Reflection with Credentials on Sensi - CVE-2026-6662
ericc-ch copilot-api Token Endpoint server.ts cors cross-dom - CVE-2026-6143
farion1231 cc-switch ProxyServer server.rs cross-domain poli
V. Comments for CVE-2023-38125
No comments yet