VulnerabilityModified
CVE-2022-44456
CONPROSYS HMI System (CHS) Ver.3.4.4?and earlier allows a remote unauthenticated attacker to execute an arbitrary OS command on the server where the product is running by sending a specially crafted request.
CRITICAL 9.8EPSS 69.9%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 69.9%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
CONPROSYS HMI System (CHS) Ver.3.4.4?and earlier allows a remote unauthenticated attacker to execute an arbitrary OS command on the server where the product is running by sending a specially crafted request.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 69.88% probability · 99th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-78
- Affected
- contec/conprosys hmi system
- Source
- vultures@jpcert.or.jp
References
- https://jvn.jp/en/vu/JVNVU96873821/index.htmlThird Party Advisory, VDB Entry
- https://www.contec.com/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_chs_221014_en.pdfVendor Advisory
- https://www.contec.com/download/contract/contract4/?itemid=ea8039aa-3434-4999-9ab6-897aa690210c&downloaditemid=866d7d3c-aae9-438d-87f3-17aa040df90bPatch, Vendor Advisory
- https://jvn.jp/en/vu/JVNVU96873821/index.htmlThird Party Advisory, VDB Entry
- https://www.contec.com/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_chs_221014_en.pdfVendor Advisory
- https://www.contec.com/download/contract/contract4/?itemid=ea8039aa-3434-4999-9ab6-897aa690210c&downloaditemid=866d7d3c-aae9-438d-87f3-17aa040df90bPatch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.