PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-5921 DECE Software CVE debrief

CVE-2023-5921 describes an improper enforcement of behavioral workflow in DECE Software Geodi that can lead to a functionality bypass. The vulnerable versions are those before 8.0.0.27396. NVD rates the issue HIGH with a CVSS 3.1 score of 7.1, and the published vector indicates a local, low-privilege attack path with no user interaction.

Vendor
DECE Software
Product
Geodi
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2023-11-22
Original CVE updated
2026-05-20
Advisory published
2023-11-22
Advisory updated
2026-05-20

Who should care

Administrators and security teams responsible for DECE Software Geodi deployments should care, especially if the product is installed on systems where local users or low-privilege accounts are present. Organizations that rely on Geodi for workflow-controlled operations should prioritize validation of their installed version.

Technical summary

The source advisory and NVD record describe an improper enforcement of behavioral workflow, categorized by USOM with CWE-841. In practical terms, the control flow or state checks intended to gate application behavior can be bypassed in affected versions of Geodi prior to 8.0.0.27396. The NVD CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) suggests a local attack requiring low privileges, with high potential impact to confidentiality and integrity but no listed availability impact.

Defensive priority

High. Because the issue is locally exploitable with low privileges and can affect confidentiality and integrity, patching or upgrading should be treated as a near-term priority for any exposed Geodi installation.

Recommended defensive actions

  • Upgrade DECE Software Geodi to version 8.0.0.27396 or later.
  • Inventory all Geodi installations and confirm the exact build/version deployed.
  • Restrict local account access and review which users have privileges on systems running Geodi.
  • Monitor vendor and advisory channels for any additional guidance or remediation notes.
  • Validate that workflow or authorization controls in dependent processes behave as expected after updating.

Evidence notes

This debrief is based only on the supplied NVD record and linked USOM references. The vulnerability is identified as CVE-2023-5921, first published on 2023-11-22, with the NVD record later modified on 2026-05-20. The source data lists affected versions before 8.0.0.27396 and includes a CWE-841 secondary classification from the advisory.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-5921 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-5921

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-5921 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-5921

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.