CVE-2023-22803

Summary

LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication to perform critical functions to the PLC. This could allow an attacker to change the PLC's mode arbitrarily.

Affected Software

Weaknesses

• CWE-306: CWE-306 Missing Authentication for Critical Function

Workarounds

LS ELECTRIC is developing mitigations (to be released tentatively by the end of 2023) and recommends users follow the provided workarounds to reduce the risk of exploitation:

• Restrict communication to the PLC to only trusted IP addresses and trusted devices by enabling the “Host Table” option in the configuration window of the PLC.

ADP Enrichment

CVE Program Container

Additional References

• https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-02

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

References

• https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-02

• ←Previous
• Next→