Description
LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication for its deletion command. This could allow an attacker to delete arbitrary files.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| icscertCNA (assigner) | 3.1 | Critical9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
| NVDNVD · Modified | 3.1 | Critical9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.69% · top 47% of all CVEs (5 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.1.
Weakness
Affected products
- affected 01.80
What to do
Workaround: LS ELECTRIC is developing mitigations (to be released tentatively by the end of 2023) and recommends users follow the provided workarounds to reduce the risk of exploitation: * Restrict communication to the PLC to only trusted IP addresses and trusted devices by enabling the “Host Table” option in the configuration window of the PLC.
References (1)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2023-0102)Record last updated .