CONPROSYS HMI System (CHS) Ver.3.4.4?and earlier allows a remote unauthenticated attacker to execute an arbitrary OS command on the server where the product is running by sending a specially crafted request.
References
| Link | Resource |
|---|---|
| https://jvn.jp/en/vu/JVNVU96873821/index.html | Third Party Advisory VDB Entry |
| https://www.contec.com/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_chs_221014_en.pdf | Vendor Advisory |
| https://www.contec.com/download/contract/contract4/?itemid=ea8039aa-3434-4999-9ab6-897aa690210c&downloaditemid=866d7d3c-aae9-438d-87f3-17aa040df90b | Patch Vendor Advisory |
Configurations
History
22 Dec 2022, 20:26
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://www.contec.com/download/contract/contract4/?itemid=ea8039aa-3434-4999-9ab6-897aa690210c&downloaditemid=866d7d3c-aae9-438d-87f3-17aa040df90b - Patch, Vendor Advisory | |
| References | (MISC) https://www.contec.com/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_chs_221014_en.pdf - Vendor Advisory | |
| References | (MISC) https://jvn.jp/en/vu/JVNVU96873821/index.html - Third Party Advisory, VDB Entry | |
| First Time |
Contec
Contec conprosys Hmi System |
|
| CPE | cpe:2.3:a:contec:conprosys_hmi_system:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CWE | CWE-78 |
19 Dec 2022, 04:00
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-12-19 03:15
Updated : 2023-12-10 14:48
NVD link : CVE-2022-44456
Mitre link : CVE-2022-44456
CVE.ORG link : CVE-2022-44456
JSON object : View
Products Affected
contec
- conprosys_hmi_system
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')