CVE-2023-28651

What it actually does

This is a stored cross-site scripting issue in the administrative web interface. A user with administrative privileges can save specially crafted configuration data that is later rendered by the application without sufficient output encoding or sanitization. When another administrative user views the affected page, the injected script executes in that user’s browser within the trusted origin of the product. The script may read page content, interact with the application as the victim, change settings, trigger administrative actions, or support session/credential theft depending on browser protections and cookie attributes. The flaw requires high privileges to plant the payload and user interaction by another administrator, but successful exploitation crosses a trust boundary between administrative users.

Why it matters to the business

An attacker who already has administrative access, or who has compromised an administrator account, may be able to abuse the management interface to affect other administrators. In operational technology or HMI contexts, this can erode trust in the console, enable unauthorized configuration changes, and create a path for broader compromise of privileged users. The issue is not listed in CISA KEV and no mature public exploit is indicated in the provided data, but the EPSS score is elevated, so exposed or internet-reachable management interfaces should still be prioritized for remediation. Organizations tracking Debian package exposure should also ensure listed affected packages are updated to the fixed release where applicable.

How an attack unfolds

An attacker first obtains or abuses an account with administrative privileges to the affected product. They navigate to a configuration or settings area that stores administrator-provided values and submit a payload containing scriptable content, such as HTML event handlers, script tags, or JavaScript URLs, crafted to survive server-side validation. The application stores the malicious setting. Later, another administrator opens the affected management page. The application renders the stored value into the page without safely encoding it, causing the browser to execute the attacker’s JavaScript under the product’s origin. The script can then perform actions available to the victim administrator, such as reading sensitive UI data, submitting configuration changes, manipulating displayed information, or attempting to exfiltrate tokens or session-related data if accessible.

How to fix it

Upgrade the affected CONPROSYS HMI System to version 3.5.3 or later. If vulnerability management tooling has mapped exposure to Debian libsass packages, verify Debian 13 and Debian 14 systems are updated to libsass version 3.6.5+20231221-2 or later. As compensating controls, restrict access to the management interface to trusted administrative networks, require multifactor authentication for administrators, review and minimize administrative users, remove untrusted or unnecessary stored configuration values, and avoid exposing the interface directly to the internet. Application owners should also enforce server-side input validation, context-aware output encoding, secure cookie attributes, CSRF protection, and a restrictive Content Security Policy to reduce XSS impact.

How to confirm the fix worked

Confirm the product version is 3.5.3 or later, or confirm the relevant Debian package version is 3.6.5+20231221-2 or later where that package mapping applies. Review administrative UI pages that display saved configuration values and verify that script-like input is rendered as inert text rather than executable code. Use an authenticated test account in a non-production environment to submit benign XSS test strings and confirm they are safely encoded on all pages where they are displayed. Validate that the management interface is not reachable from untrusted networks and that all administrator accounts are expected, MFA-protected, and recently reviewed.

Typical attack path

1. Obtain administrative access to the affected product through legitimate access, insider misuse, credential theft, or prior compromise.
2. Identify an administrative setting or configuration field that is rendered back to other administrators.
3. Submit a crafted stored XSS payload into the vulnerable setting.
4. Wait for or lure another administrator to view the affected page in the management interface.
5. Execute JavaScript in the victim administrator’s browser under the trusted product origin.
6. Use the victim’s active session to read sensitive UI data, alter configuration, create persistence through additional malicious settings, or attempt token/session theft where browser protections allow.

How to detect it

Review web server, reverse proxy, application audit, and administrative activity logs for stored script payloads submitted to configuration or settings endpoints. Focus on requests made by administrator accounts that include HTML tags, JavaScript schemes, encoded script content, or event-handler attributes. Examine saved product configuration exports or backups for embedded scripts or external URLs in fields that should contain plain text, labels, names, descriptions, or display settings. Look for cases where one administrator changed a setting shortly before another administrator accessed the same page, followed by unexpected administrative actions, configuration changes, new users, or outbound web requests from administrator workstations to unfamiliar domains. Endpoint telemetry from administrator workstations may show browser connections to suspicious external hosts immediately after visiting the management interface. Because this is a stored XSS flaw, indicators are most likely to appear as malicious values in application data and HTTP request bodies rather than as standalone malware artifacts.

• <script
• </script>
• javascript:
• onerror=
• onload=
• onclick=
• onmouseover=
• document.cookie
• document.domain
• localStorage
• sessionStorage
• XMLHttpRequest
• fetch(
• new Image(
• eval(
• String.fromCharCode
• atob(
• btoa(
• %3Cscript
• %3C%2Fscript%3E
• %6a%61%76%61%73%63%72%69%70%74%3a
• &#x3c;script
• data:text/html
• data:application/javascript

What your security team should do

• Prioritize patching internet-accessible or operationally critical management interfaces, especially given the elevated EPSS score.
• Upgrade CONPROSYS HMI System to 3.5.3 or later and verify any mapped Debian libsass packages are at 3.6.5+20231221-2 or later.
• Audit administrative accounts for unexpected users, recent privilege changes, stale accounts, and signs of credential compromise.
• Review recent configuration changes made by administrative users for embedded script, HTML, event-handler attributes, or suspicious external URLs.
• Restrict the administrative interface to VPN, jump hosts, or trusted management networks only.
• Add SIEM detections for script-like payloads in administrative setting changes and for administrative pages requesting unexpected external domains.
• If suspicious payloads are found, preserve logs, export configuration state, rotate affected administrator credentials, invalidate active sessions, and remove malicious stored values.