CVE-2023-22339

CONPROSYS HMI System (CHS) by Contec is affected by CVE-2023-22339 due to improper access control in 3.4.5 and earlier. This vulnerability could let a remote unauthenticated attacker bypass access restrictions and obtain the server certificate, including the private key. Affected versions: 3.4.5 ...

CVE-2023-22331

CVE-2023-22331 affects CONPROSYS HMI System (CHS) by a default-credentials vulnerability in versions 3.4.5 and earlier, allowing a remote unauthenticated attacker to alter user credentials information. The issue arises from use of default credentials (CWE-1392) in CHS, with a CVSS v3 base score o...

CVE-2023-28399

The CVE-2023-28399 issue affects CONPROSYS HMI System (CHS) before version 3.5.3. The root cause is an incorrect ACL permissions setup on the local installation folder, granting a wide range of privileges to a PC user. Impact, as described in the sources, includes potential destruction of the sys...

CVE-2023-29154

CVE-2023-29154 affects Contec CONPROSYS HMI System (CHS) prior to version 3.5.3. The vulnerability is an SQL injection that allows a user with administrative privileges to execute arbitrary SQL commands through specially crafted input on the query setting page. Several sources (including CVE list...

CVE-2025-34081

The CVE-2025-34081 affects Contec CONPROSYS HMI System (CHS) prior to version 3.7.7. The issue is the exposure of a PHP phpinfo() debugging page to unauthenticated users, which may disclose sensitive runtime information useful to an attacker. Public sources in the connected documents confirm the ...