Description

Omron CS series, CJ series, and CP series PLCs through 2022-05-18 use cleartext passwords. They feature a UM Protection setting that allows users or system integrators to configure a password in order to restrict sensitive engineering operations (such as project/logic uploads and downloads). This password is set using the OMRON FINS command Program Area Protect and unset using the command Program Area Protect Clear, both of which are transmitted in cleartext.

Related CPE's

o

omron

sysmac_cs1_firmware

Vulnerable

h

omron

sysmac_cs1

-

o

omron

sysmac_cj2m_firmware

Vulnerable

h

omron

sysmac_cj2m

-

o

omron

sysmac_cj2h_firmware

Vulnerable

h

omron

sysmac_cj2h

-

o

omron

sysmac_cp1e_firmware

Vulnerable

h

omron

sysmac_cp1e

-

o

omron

sysmac_cp1h_firmware

Vulnerable

h

omron

sysmac_cp1h

-

o

omron

sysmac_cp1l_firmware

Vulnerable

h

omron

sysmac_cp1l

-

o

omron

cp1w-cif41_firmware

-

Vulnerable

h

omron

cp1w-cif41

-

a

omron

cx-programmer

Vulnerable

References

https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-02

Third Party AdvisoryUS Government Resource

https://www.forescout.com/blog/

Third Party Advisory

Weaknesses

[email protected]

Primary
CWE-319

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.5 · High

  • CVSS V3.1

  • CVSS V3.0

  • CVSS V2.0

Information

Source identifier

[email protected]

Vulnerability status

Analyzed

Published

2022-07-26T22:15:11.317

2 years ago

Last modified

2022-08-04T14:59:59.737

2 years ago