CVE-2022-2758 - CVE House
Back to Database
Status published Medium CVE-2022-2758

Update

Vulnerability Description

Passwords are not adequately encrypted during the communication process between all versions of LS Industrial Systems (LSIS) Co. Ltd LS Electric XG5000 software prior to V4.0 and LS Electric PLCs: all versions of XGK-CPUU/H/A/S/E prior to V3.50, all versions of XGI-CPUU/UD/H/S/E prior to V3.20, all versions of XGR-CPUH prior to V1.80, all versions of XGB-XBMS prior to V3.00, all versions of XGB-XBCH prior to V1.90, and all versions of XGB-XECH prior to V1.30. This would allow an attacker to identify and decrypt the password of the affected PLCs by sniffing the PLC’s communication traffic.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-2758

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Hong-Gi Kin of the Korea Internet & Security Agency (KISA) reported this vulnerability.

References

Affected Vendor

LS Industrial Systems (LSIS) Co. Ltd LS Electric

View all reports →

Affected Software

XG5000, PLC: XGB-XECH, PLC: XGB-XBCH, PLC: XGB-XBMS, PLC: XGR-CPUH, PLC: XGI-CPUU/UD/H/S/E, PLC: XGK-CPUU/H/A/S/E
Vulnerable Versions:
All versions

Timeline

Official Publish: August 31st, 2022
Last Modified: April 16th, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-326

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.