title: Update
description: Passwords are not adequately encrypted during the communication process between all versions of LS Industrial Systems (LSIS) Co. Ltd LS Electric XG5000 software prior to V4.0 and LS Electric PLCs: all versions of XGK-CPUU/H/A/S/E prior to V3.50, all versions of XGI-CPUU/UD/H/S/E prior to V3.20, all versions of XGR-CPUH prior to V1.80, all versions of XGB-XBMS prior to V3.00, all versions of XGB-XBCH prior to V1.90, and all versions of XGB-XECH prior to V1.30. This would allow an attacker to identify and decrypt the password of the affected PLCs by sniffing the PLC’s communication traffic.
problem types: CWE-326 Inadequate Encryption Strength
affected:
{
vendor: LS Industrial Systems (LSIS) Co. Ltd LS Electric
product: XG5000
versions:
version: All versions, status: affected, lessThan: V4.0, versionType: custom
}
{
vendor: LS Industrial Systems (LSIS) Co. Ltd LS Electric
product: PLC: XGB-XECH
versions:
version: All versions, status: affected, lessThan: V1.30, versionType: custom
}
{
vendor: LS Industrial Systems (LSIS) Co. Ltd LS Electric
product: PLC: XGB-XBCH
versions:
version: All versions, status: affected, lessThan: V1.90, versionType: custom
}
{
vendor: LS Industrial Systems (LSIS) Co. Ltd LS Electric
product: PLC: XGB-XBMS
versions:
version: All versions, status: affected, lessThan: V3.00, versionType: custom
}
{
vendor: LS Industrial Systems (LSIS) Co. Ltd LS Electric
product: PLC: XGR-CPUH
versions:
version: All versions, status: affected, lessThan: V1.80, versionType: custom
}
{
vendor: LS Industrial Systems (LSIS) Co. Ltd LS Electric
product: PLC: XGI-CPUU/UD/H/S/E
versions:
version: All versions, status: affected, lessThan: V3.20, versionType: custom
}
{
vendor: LS Industrial Systems (LSIS) Co. Ltd LS Electric
product: PLC: XGK-CPUU/H/A/S/E
versions:
version: All versions, status: affected, lessThan: V3.50, versionType: custom
}
metrics:
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
]