CVE-2023-28651: CONPROSYS HMI System stored XSS via admin-configured settings

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

medium priorityThe flaw requires existing administrative privileges and victim interaction, limiting reach, though it enables script execution in other privileged sessions and carries a high EPSS score.

What it is

CONPROSYS HMI System (CHS) before 3.5.3 contains a cross-site scripting flaw (CWE-79). An administrator who configures specially crafted settings can cause an arbitrary script to run in the browser of another administrator accessing the product. Because the injected content is stored in product settings, the script executes for other privileged users rather than the one who entered it.

Impact

An attacker with administrative access can execute arbitrary script in another administrator's browser session, enabling session or credential theft and actions performed with the victim's privileges. The scope change in the CVSS vector means the script can affect resources beyond the vulnerable component.

Attack surface

Reached over the network through the product's web interface; the attacker must already hold administrative privileges to configure the malicious settings, and the victim must access the affected product, so user interaction is required. No unauthenticated or remote-without-credentials path is described.

Exploitation

Not listed in CISA KEV and no public exploit or exploitation activity is indicated in the references, which are only vendor and third-party advisories. EPSS is high (0.62419, 99.1st percentile), suggesting elevated likelihood of attempted exploitation, but this is a probability score, not evidence of active exploitation.

What to do

• Upgrade CONPROSYS HMI System to version 3.5.3 or later per the vendor advisory.
• Restrict administrative access to the CHS web interface to trusted networks and accounts.
• Apply output encoding and input validation to administrator-configurable settings fields.
• Enforce a content security policy and secure session cookie attributes on the CHS web interface.
• Review administrator accounts and remove unnecessary privileged users.

Detection

• Monitor CHS administrative configuration changes for injected script or HTML markup in settings fields.
• Alert on unexpected script execution or outbound requests originating from administrator browser sessions on the CHS interface.
• Audit web server and application logs for anomalous requests tied to configuration pages from privileged accounts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.