CVE-2023-0102

Summary

LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication for its deletion command. This could allow an attacker to delete arbitrary files.

Affected Software

Weaknesses

• CWE-306: CWE-306 Missing Authentication for Critical Function

Workarounds

LS ELECTRIC is developing mitigations (to be released tentatively by the end of 2023) and recommends users follow the provided workarounds to reduce the risk of exploitation:

• Restrict communication to the PLC to only trusted IP addresses and trusted devices by enabling the “Host Table” option in the configuration window of the PLC.

ADP Enrichment

CVE Program Container

Additional References

• https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-02

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

References

• https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-02

• ←Previous
• Next→