CVE-2022-44456

Deeper analysis

CVE-2022-44456 is an OS command injection vulnerability (CWE-78) affecting CONPROSYS HMI System (CHS) version 3.4.4 and earlier. The flaw resides in the handling of specially crafted requests sent to the server component, enabling unauthenticated remote command execution with a CVSS v3.1 base score of 9.8 reflecting network attack vector, low complexity, and no required privileges or user interaction.

An attacker positioned on the network can submit malicious requests to the affected HMI system and obtain arbitrary operating-system command execution on the underlying server. Successful exploitation grants full control over confidentiality, integrity, and availability of the host, consistent with the high impact metrics in the CVSS vector.

Vendor advisories published by CONTEC and coordinated through JVN recommend applying the security updates referenced in the linked PDFs and product pages; the advisories address the command-injection issue in CHS releases after 3.4.4.

EPSS for this CVE rose from a low baseline to a peak of 0.4139 before settling at the current value of 0.2519, indicating that exploitation interest increased after public disclosure and that the vulnerability merits renewed attention.