CVE-2023-22807

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

LS ELECTRIC XBC-DN32U with operating system version 01.80 does not properly control access to the PLC over its internal XGT protocol. An attacker could control and tamper with the PLC by sending the packets to the PLC over its XGT protocol.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
LS Electric	XBC-DN32U	Operating System Version 01.80

References

https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-02Third Party Advisory, US Government Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-23-040-02Third Party Advisory, US Government Resource

Timeline

Published: Feb 15, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-228083.3An issue was discovered in the Arm Android Gralloc Module. A non-privileged user can read a small portion of the allocator process memory. T CVE-2023-228097.8In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_ED CVE-2023-22814.3When archiving a team, Mattermost fails to sanitize the related Websocket event sent to currently connected clients. This allows the clients CVE-2023-228127.4SanDisk PrivateAccess versions prior to 6.4.9 support insecure TLS 1.0 and TLS 1.1 protocols which are susceptible to man-in-the-middle atta CVE-2023-228134.3A device API endpoint was missing access controls on Western Digital My Cloud OS 5 iOS and Anroid Mobile Apps, My Cloud Home iOS and Android CVE-2023-228149.8An authentication bypass issue via spoofing was discovered in the token-based authentication mechanism that could allow an attacker to carry CVE-2023-228156.7Post-authentication remote command injection vulnerability in Western Digital My Cloud OS 5 devices that could allow an attacker to execute CVE-2023-228168.8A post-authentication remote command injection vulnerability in a CGI file in Western Digital My Cloud OS 5 devices that could allow an atta CVE-2023-228175.5Server-side request forgery (SSRF) vulnerability that could allow a rogue server on the local network to modify its URL using another DNS ad CVE-2023-228187.8Multiple DLL Search Order Hijack vulnerabilities were addressed in the SanDisk Security Installer for Windows that could allow attackers wit CVE-2023-228194.9An uncontrolled resource consumption vulnerability issue that could arise by sending crafted requests to a service to consume a large amount CVE-2023-22826.5Improper access control in the Web Login listener in Devolutions Remote Desktop Manager 2023.1.22 and earlier on Windows allows an authentic