PT-2023-16540 · Omron · Omron Cj1M

Sam Hanson · Publicado 2023-03-16 · Atualizado 2023-03-28 · CVE-2023-0811

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Omron CJ1M unit versions 4.0 and prior

Description The issue is related to improper access controls on the memory region where the UM password is stored. An adversary can issue a PROGRAM AREA WRITE command to a specific memory region, potentially overwriting the password. This could lead to disabling UM protections or setting a non-ASCII password, preventing an engineer from viewing or modifying the user program.

Recommendations For Omron CJ1M unit versions 4.0 and prior, consider restricting access to the PROGRAM AREA WRITE command to minimize the risk of exploitation. As a temporary workaround, limit the ability to modify the UM password to authorized personnel only. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

BDU:2025-01925

CVE-2023-0811

Produtos afetados

Omron Cj1M

Referências · 7

• https://cisa.gov/news-events/ics-advisories/icsa-23-073-01 · Nota
• https://t.me/cibsecurity/60175 · Publicação no Telegram
• https://ia.omron.com/product/vulnerability/OMSR-2023-001_en.pdf · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-0811 · Nota de Segurança
• https://bdu.fstec.ru/vul/2025-01925 · Nota de Segurança
• https://t.me/cvenotify/46353 · Publicação no Telegram
• https://fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2023-001_en.pdf · Nota