CVE-2023-2758 Contec CONPROSYS HMI System (CHS) v3.5.2 Denial of Service
Remote unauthenticated attackers can deny logins for an extended period due to time-zone mismatches in configuration files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-2758?
CVE-2023-2758 is a low-severity denial of service vulnerability in Contec CONPROSYS HMI System, published on 31 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A denial of service vulnerability exists in Contec CONPROSYS HMI System versions 3.5.2 and prior. When there is a time-zone mismatch in certain configuration files, a remote, unauthenticated attacker may deny logins for an extended period of time.
Weakness: CWE-799
Which versions are affected by CVE-2023-2758?
It affects 1 product.
Products include Contec Conprosys Hmi System.
How do I fix CVE-2023-2758?
No fix has been published for CVE-2023-2758 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-2758 being exploited?
There is no known exploitation of CVE-2023-2758 in the wild and no public exploit code.
Other vulnerabilities in Contec CONPROSYS HMI System
- CVE-2022-44456 Command injection in CONPROSYS HMI System (CHS)
- CVE-2023-28657 Privilege escalation in CONPROSYS HMI System (CHS)
- CVE-2023-28713 Information disclosure in CONPROSYS HMI System (CHS)
- CVE-2023-28399 Missing authorization in CONPROSYS HMI System (CHS)
- CVE-2023-22331 Hardcoded credentials in CONPROSYS HMI System (CHS)
Sources
Also known as GHSA-grw6-p9qm-qmx4.