CVE-2023-28399

HIGH

CONPROSYS HMI System < 3.5.3 - Incorrect Permission Assignment for Critical Resource

Title source: llm

Description

Incorrect permission assignment for critical resource exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. ACL (Access Control List) is not appropriately set to the local folder where the affected product is installed, therefore a wide range of privileges is permitted to a user of the PC where the affected product is installed. As a result, the user may be able to destroy the system and/or execute a malicious program.

References (3)

Core 3

Core References

Third Party Advisory

https://jvn.jp/en/vu/JVNVU93372935/

Vendor Advisory

https://www.contec.com/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_chs_230531_en.pdf

Vendor Advisory

https://www.contec.com/jp/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_chs_230531_jp.pdf

Scores

CVSS v3 7.8

EPSS 0.0018

EPSS Percentile 7.9%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-732

Status published

Products (1)

contec/conprosys_hmi_system < 3.5.3

Published Jun 01, 2023

Tracked Since Feb 18, 2026