CVE-2023-22804

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication to create users on the PLC. This could allow an attacker to create and use an account with elevated privileges and take control of the device.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published
Feb 15, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-228054.3LS ELECTRIC XBC-DN32U with operating system version 01.80 has improper access control to its read prohibition feature. This could allow a reCVE-2023-228067.5LS ELECTRIC XBC-DN32U with operating system version 01.80 transmits sensitive information in cleartext when communicating over its XGT protoCVE-2023-228079.8LS ELECTRIC XBC-DN32U with operating system version 01.80 does not properly control access to the PLC over its internal XGT protocol. An atCVE-2023-228083.3An issue was discovered in the Arm Android Gralloc Module. A non-privileged user can read a small portion of the allocator process memory. TCVE-2023-228097.8In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDCVE-2023-22814.3When archiving a team, Mattermost fails to sanitize the related Websocket event sent to currently connected clients. This allows the clientsCVE-2023-228127.4SanDisk PrivateAccess versions prior to 6.4.9 support insecure TLS 1.0 and TLS 1.1 protocols which are susceptible to man-in-the-middle attaCVE-2023-228134.3A device API endpoint was missing access controls on Western Digital My Cloud OS 5 iOS and Anroid Mobile Apps, My Cloud Home iOS and AndroidCVE-2023-228149.8An authentication bypass issue via spoofing was discovered in the token-based authentication mechanism that could allow an attacker to carryCVE-2023-228156.7Post-authentication remote command injection vulnerability in Western Digital My Cloud OS 5 devices that could allow an attacker to execute CVE-2023-228168.8A post-authentication remote command injection vulnerability in a CGI file in Western Digital My Cloud OS 5 devices that could allow an attaCVE-2023-228175.5Server-side request forgery (SSRF) vulnerability that could allow a rogue server on the local network to modify its URL using another DNS ad
CVE-2023-22804: Critical severity, CVSS 9.8 | Vulnix