CVE-2022-44456: CONPROSYS HMI System OS command injection via crafted request

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication, no user interaction, and high EPSS make this a critical pre-auth remote code execution risk.

What it is

CONPROSYS HMI System (CHS) Ver.3.4.4 and earlier contains an OS command injection flaw (CWE-78). A remote attacker can send a specially crafted request to execute arbitrary OS commands on the server hosting the product. The flaw is network-reachable, needs no authentication or user interaction, and carries a critical CVSS score of 9.8.

Impact

An attacker gains arbitrary OS command execution on the CHS server, which can lead to full compromise of confidentiality, integrity and availability of that host. This may allow data theft, service disruption, or use of the server as a pivot into the industrial control environment.

Attack surface

The vulnerability is reachable over the network via a crafted request to the CHS service, as reflected by the AV:N vector. No authentication (PR:N) and no user interaction (UI:N) are required, so any host that can reach the CHS interface is a potential entry point.

Exploitation

The record does not state that exploitation has been observed; CVE-2022-44456 is not listed in CISA KEV and no ransomware usage is documented. EPSS is high (0.69877, 99.3rd percentile), indicating a strong likelihood of attempted exploitation, and vendor references include a patch advisory.

What to do

• Apply the vendor patch from the CON-TEC advisory for CHS (patch reference in the record) and upgrade beyond Ver.3.4.4.
• Restrict network access to the CHS server so only trusted management hosts can reach its service ports.
• Place CHS behind a firewall or segmented network zone and avoid exposing it to untrusted networks or the internet.
• Monitor vendor advisories and JVN VU96873821 for updated guidance and any revised fixed versions.
• If patching is delayed, consider temporary compensating controls such as an application-layer filter or WAF rule blocking malformed requests to CHS.

Detection

• Monitor CHS server process logs and OS audit logs for unexpected child processes or command shells spawned by the CHS service.
• Alert on suspicious outbound connections or file writes originating from the CHS server host.
• Review network traffic to CHS management ports for anomalous or malformed requests, especially from unexpected source addresses.
• Correlate endpoint detection alerts for command execution (e.g., cmd.exe, /bin/sh) with the CHS service process on the same host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.