Vulnerability · Published Jun 1, 2023 · Assigned by jpcert
CVE-2023-28713
High 8.1
In plain English
A high-severity security flaw in CONPROSYS HMI System (CHS) from Contec Co., Ltd.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).
Official description
Plaintext storage of a password exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. Because account information of the database is saved in a local file in plaintext, a user who can access the PC where the affected product is installed can obtain the information. As a result, information in the database may be obtained and/or altered by the user.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Contec Co., Ltd. | CONPROSYS HMI System (CHS) | versions prior to 3.5.3 |
Weakness: CWE-312 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N