Sign-up

ID

VAR-202302-0671


CVE

CVE-2023-22807


TITLE

ls-electric  of  xbc-dn32u  Firmware vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2023-004158

DESCRIPTION

LS ELECTRIC XBC-DN32U with operating system version 01.80 does not properly control access to the PLC over its internal XGT protocol. An attacker could control and tamper with the PLC by sending the packets to the PLC over its XGT protocol. ls-electric of xbc-dn32u There are unspecified vulnerabilities in the firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. LS ELECTRIC XBC-DN32U is a PLC programmable logic controller produced by LS ELECTRIC in Korea

Trust: 2.25

sources: NVD: CVE-2023-22807 // JVNDB: JVNDB-2023-004158 // CNVD: CNVD-2023-21677 // VULMON: CVE-2023-22807

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2023-21677

AFFECTED PRODUCTS

vendor:ls electricmodel:xbc-dn32uscope:eqversion:01.80

Trust: 1.0

vendor:ls electricmodel:xbc-dn32uscope:eqversion:xbc-dn32u firmware 01.80

Trust: 0.8

vendor:ls electricmodel:xbc-dn32uscope:eqversion: -

Trust: 0.8

vendor:ls electricmodel:xbc-dn32uscope: - version: -

Trust: 0.8

vendor:lsmodel:electric xbc-dn32uscope:eqversion:01.80

Trust: 0.6

sources: CNVD: CNVD-2023-21677 // JVNDB: JVNDB-2023-004158 // NVD: CVE-2023-22807

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2023-22807
value: CRITICAL

Trust: 1.0

ics-cert@hq.dhs.gov: CVE-2023-22807
value: CRITICAL

Trust: 1.0

NVD: CVE-2023-22807
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2023-21677
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202302-1269
value: CRITICAL

Trust: 0.6

CNVD: CNVD-2023-21677
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2023-22807
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 2.0

NVD: CVE-2023-22807
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2023-21677 // JVNDB: JVNDB-2023-004158 // CNNVD: CNNVD-202302-1269 // NVD: CVE-2023-22807 // NVD: CVE-2023-22807

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:CWE-284

Trust: 1.0

problemtype:Lack of information (CWE-noinfo) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2023-004158 // NVD: CVE-2023-22807

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202302-1269

TYPE

access control error

Trust: 0.6

sources: CNNVD: CNNVD-202302-1269

EXTERNAL IDS

db:NVDid:CVE-2023-22807

Trust: 3.9

db:ICS CERTid:ICSA-23-040-02

Trust: 3.1

db:JVNid:JVNVU97136726

Trust: 0.8

db:JVNDBid:JVNDB-2023-004158

Trust: 0.8

db:CNVDid:CNVD-2023-21677

Trust: 0.6

db:CNNVDid:CNNVD-202302-1269

Trust: 0.6

db:VULMONid:CVE-2023-22807

Trust: 0.1

sources: CNVD: CNVD-2023-21677 // VULMON: CVE-2023-22807 // JVNDB: JVNDB-2023-004158 // CNNVD: CNNVD-202302-1269 // NVD: CVE-2023-22807

REFERENCES

url:https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-02

Trust: 3.1

url:https://jvn.jp/vu/jvnvu97136726/

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2023-22807

Trust: 0.8

url:https://cxsecurity.com/cveshow/cve-2023-22807/

Trust: 0.6

sources: CNVD: CNVD-2023-21677 // VULMON: CVE-2023-22807 // JVNDB: JVNDB-2023-004158 // CNNVD: CNNVD-202302-1269 // NVD: CVE-2023-22807

SOURCES

db:CNVDid:CNVD-2023-21677
db:VULMONid:CVE-2023-22807
db:JVNDBid:JVNDB-2023-004158
db:CNNVDid:CNNVD-202302-1269
db:NVDid:CVE-2023-22807

LAST UPDATE DATE

2024-08-14T13:42:05.104000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2023-21677date:2023-03-29T00:00:00
db:JVNDBid:JVNDB-2023-004158date:2023-10-26T04:54:00
db:CNNVDid:CNNVD-202302-1269date:2023-02-27T00:00:00
db:NVDid:CVE-2023-22807date:2023-11-07T04:07:25.663

SOURCES RELEASE DATE

db:CNVDid:CNVD-2023-21677date:2023-03-29T00:00:00
db:JVNDBid:JVNDB-2023-004158date:2023-10-26T00:00:00
db:CNNVDid:CNNVD-202302-1269date:2023-02-15T00:00:00
db:NVDid:CVE-2023-22807date:2023-02-15T18:15:12.087