Critical ICSA-22-347-03 5 CVEs

Contec CONPROSYS HMI System (CHS)

Published Dec 13, 2022 · Updated Jan 19, 2023 · Revision 2

Vendor: Contec Product: CONPROSYS HMI System(CHS)

Summary

Successful exploitation of these vulnerabilities could allow a remote attacker to send specially crafted requests and cause a loss of sensitive information.

Vulnerabilities 5

Critical 9.8

CVE-2022-44456 EPSS 70%

CONPROSYS HMI System (CHS) Ver.3.4.4?and earlier allows a remote unauthenticated attacker to execute an arbitrary OS co…

Contec CONPROSYS HMI System(CHS)

Dec 19, 2022
High 7.5

CVE-2023-22331

Use of default credentials vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remote unauthenti…

Contec CONPROSYS HMI System(CHS)

Jan 20, 2023
High 7.5

CVE-2023-22339

Improper access control vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remote unauthenticat…

Contec CONPROSYS HMI System(CHS)

Jan 20, 2023
Medium 5.4

CVE-2023-22373

Cross-site scripting vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remote authenticated at…

Contec CONPROSYS HMI System(CHS)

Jan 20, 2023
Medium 5.3

CVE-2023-22334

Use of password hash instead of password for authentication vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and e…

Contec CONPROSYS HMI System(CHS)

Jan 20, 2023

Revision history

2023-01-19 #2
Contec CONPROSYS HMI System (CHS) Update A (Update A)
2022-12-13 #1
Contec CONPROSYS HMI System (CHS) Update A

References

ICS Advisory ICSA-22-347-03 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-22-347-03
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf