CVE-2023-28399 Missing authorization in CONPROSYS HMI System (CHS)

High 7.8 Published 1 Jun 2023 Updated 9 Jan 2025

Local users can execute malicious code or destroy the system due to incorrect file permissions on the installation folder.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-28399?

CVE-2023-28399 is a high-severity missing authorization vulnerability in Contec Co., Ltd. CONPROSYS HMI System (CHS), published on 1 Jun 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Incorrect permission assignment for critical resource exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. ACL (Access Control List) is not appropriately set to the local folder where the affected product is installed, therefore a wide range of privileges is permitted to a user of the PC where the affected product is installed. As a result, the user may be able to destroy the system and/or execute a malicious program.

Weakness: CWE-732

Which versions are affected by CVE-2023-28399?

It affects 1 product.

Products include Contec Conprosys Hmi System.

How do I fix CVE-2023-28399?

No fix has been published for CVE-2023-28399 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-28399 being exploited?

There is no known exploitation of CVE-2023-28399 in the wild and no public exploit code.

Sources

Also known as GHSA-vwgg-32x4-wm56.