Vulnerabilities > CVE-2023-22339 - Unspecified vulnerability in Contec Conprosys HMI System

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

low complexity

contec

NVD

Published: 2023-01-20

Updated: 2023-01-26

Summary

Improper access control vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remote unauthenticated attacker to bypass access restriction and obtain the server certificate including the private key of the product.

Vulnerable Configurations

Part	Description	Count
Application	Contec Contec Conprosys HMI System 3.3.0 Contec Conprosys HMI System 3.4.3 Contec Conprosys HMI System 3.4.4 Contec Conprosys HMI System 3.4.5	4

References

https://jvn.jp/en/vu/JVNVU96873821
https://www.contec.com/download/contract/contract4/?itemid=ea8039aa-3434-4999-9ab6-897aa690210c&downloaditemid=866d7d3c-aae9-438d-87f3-17aa040df90b
https://www.cisa.gov/uscert/ics/advisories/icsa-22-347-03
https://www.contec.com/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_chs_230110_en.pdf