CVE-2023-22334 Auth bypass in CONPROSYS HMI System (CHS)
Remote attackers can intercept credentials via man-in-the-middle attacks due to improper authentication handling in CONPROSYS HMI systems.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-22334?
CVE-2023-22334 is a medium-severity authentication bypass vulnerability in Contec Co., Ltd. CONPROSYS HMI System (CHS), published on 20 Jan 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Use of password hash instead of password for authentication vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remote authenticated attacker to obtain user credentials information via a man-in-the-middle attack.
Weakness: CWE-287
Which versions are affected by CVE-2023-22334?
It affects 1 product.
Products include Contec Conprosys Hmi System.
How do I fix CVE-2023-22334?
No fix has been published for CVE-2023-22334 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-22334 being exploited?
There is no known exploitation of CVE-2023-22334 in the wild and no public exploit code.
Other vulnerabilities in Contec Co., Ltd. CONPROSYS HMI System (CHS)
- CVE-2022-44456 Command injection in CONPROSYS HMI System (CHS)
- CVE-2023-28657 Privilege escalation in CONPROSYS HMI System (CHS)
- CVE-2023-28713 Information disclosure in CONPROSYS HMI System (CHS)
- CVE-2023-28399 Missing authorization in CONPROSYS HMI System (CHS)
- CVE-2023-22331 Hardcoded credentials in CONPROSYS HMI System (CHS)
Sources
Also known as GHSA-4h9q-9r2g-27j5.