Security Resilience

CVE-2023-39478

Softing Secure Integration Server 1.22.0.8686

Published
03 May 2024
Modified
12 August 2025
CVSS Score v3.1 8.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.016 75th percentile
Risk Priority 67 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2023-39478 is a high-severity Exposure of Resource to Wrong Sphere (CWE-668) vulnerability in Softing Secure Integration Server. Its CVSS base score is 8.8 (High).

Operationally, ranked in the top 25% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability Data

Softing Secure Integration Server Exposure of Resource to Wrong Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Softing Secure Integration Server. Although authentication is required to exploit this vulnerability, the…

more

existing authentication mechanism can be bypassed. The specific flaw exists within the handling of OPC FileDirectory namespaces. The issue results from the lack of proper validation of user-supplied data before using it to create a server object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-20547.

CWE(s)
CWE-668

Related Threats

CVEs Like This One

CVE-2023-39480Same product: Softing Secure Integration Server
CVE-2023-39481Same product: Softing Secure Integration Server
CVE-2023-39479Same product: Softing Secure Integration Server
CVE-2023-27335Same product: Softing Secure Integration Server
CVE-2023-39482Same product: Softing Secure Integration Server
CVE-2023-38125Same product: Softing Secure Integration Server
CVE-2023-27336Same product: Softing Secure Integration Server
CVE-2023-27334Same product: Softing Secure Integration Server
CVE-2024-0860Same vendor: Softing
CVE-2023-37572Same vendor: Softing

Affected Assets

softing
secure integration server
1.22.0.8686

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match

Access enforcement directly stops resources from being reachable by actors outside the intended control sphere.

AC-4 Information Flow Enforcement good match

Information flow enforcement structurally prevents unintended cross-sphere data or resource exposure.

AC-6 Least Privilege good match

Least privilege reduces the set of actors that can reach a resource, limiting wrong-sphere exposure.

AC-16 Security and Privacy Attributes partial match

Security attributes enable correct sphere assignment and subsequent enforcement decisions.

SC-7 Boundary Protection partial match

Boundary protection at interfaces prevents resources from being exposed outside authorized spheres.

Hardening callouts derived

DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.

  • No fine-grained STIG row for CWE-668, a class-level weakness. Rules are authored against its narrower children: CWE-427, CWE-552.

References