CVE-2023-22804
📋 TL;DR
This vulnerability allows unauthenticated attackers to create administrative accounts on LS ELECTRIC XBC-DN32U PLCs running OS version 01.80. Attackers can gain full control of affected industrial control devices, potentially disrupting operations or causing physical damage. Organizations using these specific PLCs are at risk.
💻 Affected Systems
- LS ELECTRIC XBC-DN32U Programmable Logic Controller
📦 What is this software?
Xbc Dn32u Firmware by Ls Electric
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of industrial control systems leading to physical damage, production shutdowns, safety system manipulation, or environmental harm.
Likely Case
Unauthorized access to PLCs allowing configuration changes, logic manipulation, or denial of service affecting industrial processes.
If Mitigated
Limited impact if network segmentation prevents access to PLCs and monitoring detects unauthorized account creation attempts.
🎯 Exploit Status
No authentication required makes exploitation trivial for anyone with network access to the device.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to version 01.81 or later
Vendor Advisory: https://www.lselectric.com/security-advisories
Restart Required: Yes
Instructions:
1. Download firmware update from LS ELECTRIC support portal. 2. Backup current PLC program. 3. Apply firmware update via programming software. 4. Restart PLC. 5. Verify new firmware version.
🔧 Temporary Workarounds
Network Segmentation
allIsolate PLCs in separate network segments with strict firewall rules preventing external and unnecessary internal access.
Access Control Lists
allImplement network ACLs to restrict access to PLC management interfaces to authorized IP addresses only.
🧯 If You Can't Patch
- Implement strict network segmentation with industrial DMZ architecture
- Deploy intrusion detection systems monitoring for unauthorized account creation attempts
🔍 How to Verify
Check if Vulnerable:
Check PLC OS version via programming software or web interface. If version is 01.80, device is vulnerable.Check Version:
Use LS ELECTRIC XG5000 programming software to read PLC system informationVerify Fix Applied:
After update, verify OS version shows 01.81 or later and test that user creation requires authentication.📡 Detection & Monitoring
Log Indicators:
- Unexpected user account creation events
- Authentication bypass attempts
- Multiple failed login attempts followed by successful access
Network Indicators:
- Unauthorized access to PLC management ports (typically 502/TCP Modbus, 80/443 HTTP/HTTPS)
- Network traffic to PLCs from unexpected sources
SIEM Query:
source="plc_logs" AND (event="user_created" OR event="auth_bypass")