CVE-2023-22805

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

LS ELECTRIC XBC-DN32U with operating system version 01.80 has improper access control to its read prohibition feature. This could allow a remote attacker to remotely set the feature to lock users out of reading data from the device.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-284

Affected software

VendorProductVersions
LS ElectricXBC-DN32UOperating System Version 01.80

References

Timeline

Published
Feb 15, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-228067.5LS ELECTRIC XBC-DN32U with operating system version 01.80 transmits sensitive information in cleartext when communicating over its XGT protoCVE-2023-228079.8LS ELECTRIC XBC-DN32U with operating system version 01.80 does not properly control access to the PLC over its internal XGT protocol. An atCVE-2023-228083.3An issue was discovered in the Arm Android Gralloc Module. A non-privileged user can read a small portion of the allocator process memory. TCVE-2023-228097.8In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDCVE-2023-22814.3When archiving a team, Mattermost fails to sanitize the related Websocket event sent to currently connected clients. This allows the clientsCVE-2023-228127.4SanDisk PrivateAccess versions prior to 6.4.9 support insecure TLS 1.0 and TLS 1.1 protocols which are susceptible to man-in-the-middle attaCVE-2023-228134.3A device API endpoint was missing access controls on Western Digital My Cloud OS 5 iOS and Anroid Mobile Apps, My Cloud Home iOS and AndroidCVE-2023-228149.8An authentication bypass issue via spoofing was discovered in the token-based authentication mechanism that could allow an attacker to carryCVE-2023-228156.7Post-authentication remote command injection vulnerability in Western Digital My Cloud OS 5 devices that could allow an attacker to execute CVE-2023-228168.8A post-authentication remote command injection vulnerability in a CGI file in Western Digital My Cloud OS 5 devices that could allow an attaCVE-2023-228175.5Server-side request forgery (SSRF) vulnerability that could allow a rogue server on the local network to modify its URL using another DNS adCVE-2023-228187.8Multiple DLL Search Order Hijack vulnerabilities were addressed in the SanDisk Security Installer for Windows that could allow attackers wit