CVE-2023-38125 is a high severity permissive cross-domain policy in Softing edgeAggregator, edgeConnector and Secure Integration Server (NVD 8.8, ZDI 7.5). ZDI says it helps chain to code execution as root. I could not confirm a fixed version, so restrict access and ask Softing for the current advisory.
What's affected
The NVD record lists three Softing products: edgeAggregator, edgeConnector and Secure Integration Server, with no version range. ZDI names edgeAggregator in the advisory. The flaw is in the web server configuration, where the lack of appropriate Content Security Policy headers permits untrusted domains. Authentication is required. ZDI says an attacker can use it together with other vulnerabilities to execute code as root. The record is dated 2024-05-03 and the vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
The sources differ on score. NVD gives 8.8 and ZDI-23-1059 gives 7.5. The ZDI timeline says the issue was reported at Pwn2Own Miami in February 2023 and that, after the vendor asked for CVE numbers, ZDI published it as a zero-day advisory on 9 August 2023 when no update had been provided. The only mitigation ZDI offers is to restrict interaction with the application. I found no fixed version in the sources I could load, so ask Softing for its current security advisory.
Weakness class: CWE-942.
How to check if you're exposed
Identify every Softing edge product on your network and note its version from the product's own web interface or release notes. Then check which networks can reach its management web interface.
curl -sI https://your-device.example/ | grep -i -E "access-control|content-security-policy"
Replace the host with your device. This shows whether permissive cross-origin headers are being sent. Only run it against systems you own.
What to do now
- List Softing edgeAggregator, edgeConnector and Secure Integration Server instances and their versions.
- Ask Softing for the current security advisory and any fixed version for this CVE.
- Limit management access to a small set of administrator workstations.
- Do not browse the Internet from machines that hold sessions to these devices.
- Review accounts on the devices and remove any that are not needed.
Why it matters
A permissive cross-domain policy lets a web page from another origin make requests to the device. If the administrator's browser holds a session, those requests can carry it. Because ZDI describes this as a link in a chain, the risk depends on what else is reachable on the same device.
The ZDI note that the only salient mitigation is to restrict interaction with the application is the practical advice for now. Treat the device like a management interface: put it on its own network, require VPN access, and keep it apart from general browsing. The CVE is not on the CISA Known Exploited Vulnerabilities list.
A permissive cross-domain policy means a web server tells browsers that pages from other origins may talk to it, often with credentials. When the list of trusted origins is too wide, or missing, a page on an untrusted site can make requests that the browser sends with the victim's session. The fix is to name the exact origins that need access and to send restrictive headers by default.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers the dependencies a code project declares. It does not see firmware, desktop software or vendor appliances, so keep this item in your asset inventory and track the vendor's advisory.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a patch?
ZDI's advisory does not name one and I could not load a Softing advisory, so ask Softing directly.
What is the interim control?
Restrict who and what can reach the management interface, which is the mitigation ZDI gives.
Sources
Last reviewed: 19 October 2026.
