CVE-2023-22806

Vulnerability

The LS ELECTRIC XBC-DN32U PLC module running operating system version 01.80 transmits sensitive information, including user credentials, in cleartext when communicating over its XGT protocol [1]. This corresponds to CWE-319: Cleartext Transmission of Sensitive Information.

Exploitation

An attacker with network access to the PLC can passively capture XGT protocol traffic to obtain sensitive information such as login credentials. No authentication or user interaction is required to eavesdrop on the unencrypted communication.

Impact

Successful exploitation allows an attacker to recover user credentials, which can be used to gain unauthorized access to the PLC. This may lead to control system compromise, including modification of PLC logic, denial of service, or further network intrusion.

Mitigation

As of the advisory date [1], LS ELECTRIC has not released a firmware update to address this vulnerability. Network administrators should isolate the affected devices using firewalls and VPNs, restrict network access to authorized hosts, and monitor for suspicious traffic. Organizations should consult the CISA advisory [1] for recommended mitigations.