CVE-2022-2758: fallo de gravedad media en LS Industrial Systems (LSIS) Co.
Update
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.5epss 0.4%
Passwords are not adequately encrypted during the communication process between all versions of LS Industrial Systems (LSIS) Co. Ltd LS Electric XG5000 software prior to V4.0 and LS Electric PLCs: all versions of XGK-CPUU/H/A/S/E prior to V3.50, all versions of XGI-CPUU/UD/H/S/E prior to V3.20, all versions of XGR-CPUH prior to V1.80, all versions of XGB-XBMS prior to V3.00, all versions of XGB-XBCH prior to V1.90, and all versions of XGB-XECH prior to V1.30. This would allow an attacker to identify and decrypt the password of the affected PLCs by sniffing the PLC’s communication traffic.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Productos afectados
LS Industrial Systems (LSIS) Co. Ltd LS Electric · PLC: XGB-XBCHLS Industrial Systems (LSIS) Co. Ltd LS Electric · PLC: XGB-XBMSLS Industrial Systems (LSIS) Co. Ltd LS Electric · PLC: XGB-XECHLS Industrial Systems (LSIS) Co. Ltd LS Electric · PLC: XGI-CPUU/UD/H/S/ELS Industrial Systems (LSIS) Co. Ltd LS Electric · PLC: XGK-CPUU/H/A/S/ELS Industrial Systems (LSIS) Co. Ltd LS Electric · PLC: XGR-CPUHLS Industrial Systems (LSIS) Co. Ltd LS Electric · XG5000