Vulnerability · Published Jun 1, 2023 · Assigned by jpcert
CVE-2023-28399
High 7.8
In plain English
A high-severity incorrect permission assignment in CONPROSYS HMI System (CHS) from Contec Co., Ltd.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).
Official description
Incorrect permission assignment for critical resource exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. ACL (Access Control List) is not appropriately set to the local folder where the affected product is installed, therefore a wide range of privileges is permitted to a user of the PC where the affected product is installed. As a result, the user may be able to destroy the system and/or execute a malicious program.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Contec Co., Ltd. | CONPROSYS HMI System (CHS) | versions prior to 3.5.3 |
Weakness: CWE-732 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H