CVE-2023-28399

HIGH

Contec Conprosys Hmi System < 3.5.3 - Incorrect Permission Assignment

Title source: rule

Description

Incorrect permission assignment for critical resource exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. ACL (Access Control List) is not appropriately set to the local folder where the affected product is installed, therefore a wide range of privileges is permitted to a user of the PC where the affected product is installed. As a result, the user may be able to destroy the system and/or execute a malicious program.

References (3)

Core 3

Core References

Third Party Advisory

https://jvn.jp/en/vu/JVNVU93372935/

Vendor Advisory

https://www.contec.com/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_chs_230531_en.pdf

Vendor Advisory

https://www.contec.com/jp/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_chs_230531_jp.pdf

Scores

CVSS v3 7.8

EPSS 0.0006

EPSS Percentile 18.8%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-732

Status published

Products (1)

contec/conprosys_hmi_system < 3.5.3

Published Jun 01, 2023

Tracked Since Feb 18, 2026