Cross-Site Scripting Vulnerability in Contec CONPROSYS HMI System
CVE-2025-34080

5.1MEDIUM

Key Information:

Vendor

Contec Co.,ltd.

Status
Conprosys Hmi System (chs)
Vendor
CVE Published:
1 July 2025

What is CVE-2025-34080?

The Contec CONPROSYS HMI System (CHS) has a vulnerability in its getqsetting.php functionality that allows attackers to execute malicious scripts reflected in the browser when users interact with the system. This impacts versions prior to 3.7.7, posing a significant threat to users who may unknowingly execute harmful scripts.

Affected Version(s)

CONPROSYS HMI System (CHS) 0

References

https://jvn.jp/en/vu/JVNVU92266386/
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alex Williams of Converge Technology Solutions
.
CVE-2025-34080 : Cross-Site Scripting Vulnerability in Contec CONPROSYS HMI System