Login Request a demo
Medium severity · published Jun 1, 2023
CVE-2023-28651
Cross-site scripting vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3
4.8
CVSS
62.4%
EPSS
No
On KEV
Description
Cross-site scripting vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. If a user who can access the affected product with an administrative privilege configures specially crafted settings, an arbitrary script may be executed on the web browser of the other user who is accessing the affected product with an administrative privilege.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)62.4% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CH
Conprosys Hmi System · Contec
before 3.5.3 · source: NVD
Affected product
CH
Conprosys Hmi System
Contec
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-28651
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-28651
Third Party Advisory
https://jvn.jp/en/vu/JVNVU93372935/
Vendor Advisory
https://www.contec.com/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_chs_230531_en.pdf
Vendor Advisory
https://www.contec.com/jp/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_chs_230531_jp.pdf
More from Conprosys Hmi System
9.8
CVE-2022-44456
CONPROSYS HMI System (CHS) Ver.3.4.4?and earlier allows a remote unauthenticated attacker to execute an arbitrary OS command on the server where the product is running by sending…
8.8
CVE-2023-28657
Improper access control vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3
8.1
CVE-2023-28713
Plaintext storage of a password exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3
7.8
CVE-2023-28399
Incorrect permission assignment for critical resource exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3
7.5
CVE-2025-34081
CONPROSYS HMI System (CHS) < 3.7.7 Exposed PHP Debug Info