CVE-2022-44456

CRITICAL

CONPROSYS HMI System < 3.4.4 - Unauthenticated OS Command Injection

Title source: llm

Description

CONPROSYS HMI System (CHS) Ver.3.4.4?and earlier allows a remote unauthenticated attacker to execute an arbitrary OS command on the server where the product is running by sending a specially crafted request.

References (3)

Core 3

Core References

Third Party Advisory, VDB Entry

https://jvn.jp/en/vu/JVNVU96873821/index.html

Vendor Advisory

https://www.contec.com/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_chs_221014_en.pdf

Patch, Vendor Advisory

https://www.contec.com/download/contract/contract4/?itemid=ea8039aa-3434-4999-9ab6-897aa690210c&downloaditemid=866d7d3c-aae9-438d-87f3-17aa040df90b

Scores

CVSS v3 9.8

EPSS 0.6988

EPSS Percentile 99.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-78

Status published

Products (1)

contec/conprosys_hmi_system < 3.4.4

Published Dec 19, 2022

Tracked Since Feb 18, 2026