CVE-2023-28399

2023-06-0100:00:00

jpcert

www.cve.org

conprosys hmi system

acl

access control list

permission assignment

critical resource

malicious program

7.8 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Incorrect permission assignment for critical resource exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. ACL (Access Control List) is not appropriately set to the local folder where the affected product is installed, therefore a wide range of privileges is permitted to a user of the PC where the affected product is installed. As a result, the user may be able to destroy the system and/or execute a malicious program.

CNA Affected

[
  {
    "vendor": "Contec Co., Ltd.",
    "product": "CONPROSYS HMI System (CHS)",
    "versions": [
      {
        "version": "versions prior to 3.5.3",
        "status": "affected"
      }
    ]
  }
]