CVE-2023-3971

HighCVSS 7.3

Published: 04/10/2023(UTC)Updated: 07/11/2026(UTC)Translated: 07/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.82%

57th percentile - higher than 57% of all known CVEs

Summary

An HTML injection flaw was found in the Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login page by injecting HTML, resulting in a complete compromise.

Risk Assessment

This may lead to complete system compromise through theft of user credentials.

Recommendation

Update the affected component to a patched version and verify that no unauthorized custom login pages were created.

Other vulnerabilities in Controller

CVE-2026-41032High
It is possible for an unauthenticated adjacent attacker to download log files of the controller, which may disclose some restricted information.

Original NVD description (English source)

An HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login page by injecting HTML, resulting in a complete compromise.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS