CVE-2023-22331 Hardcoded credentials in CONPROSYS HMI System (CHS)
Remote attackers can use default credentials to alter user information in CONPROSYS HMI systems, requiring vendor upgrades.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-22331?
CVE-2023-22331 is a high-severity vulnerability in Contec Co., Ltd. CONPROSYS HMI System (CHS), published on 20 Jan 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Use of default credentials vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remote unauthenticated attacker to alter user credentials information.
Weakness: CWE-269
Which versions are affected by CVE-2023-22331?
It affects 1 product.
Products include Contec Conprosys Hmi System.
How do I fix CVE-2023-22331?
No fix has been published for CVE-2023-22331 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-22331 being exploited?
There is no known exploitation of CVE-2023-22331 in the wild and no public exploit code.
Other vulnerabilities in Contec Co., Ltd. CONPROSYS HMI System (CHS)
- CVE-2022-44456 Command injection in CONPROSYS HMI System (CHS)
- CVE-2023-28657 Privilege escalation in CONPROSYS HMI System (CHS)
- CVE-2023-28713 Information disclosure in CONPROSYS HMI System (CHS)
- CVE-2023-28399 Missing authorization in CONPROSYS HMI System (CHS)
- CVE-2023-22339 Missing authorization in CONPROSYS HMI System (CHS)
Sources
Also known as GHSA-fh24-27cp-jr28.