PT-2022-3476 · Omron · Nx1 Series+4

Published 2022-06-21 · Updated 2023-09-21 · CVE-2022-34151

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Machine automation controller NJ series versions 1.48 and earlier Machine automation controller NX7 series versions 1.28 and earlier Machine automation controller NX1 series versions 1.48 and earlier Automation software 'Sysmac Studio' versions 1.49 and earlier Programmable Terminal (PT) NA series NA5-15W/NA5-12W/NA5-9W/NA5-7W models Runtime versions 1.15 and earlier

Description A use of hard-coded credentials vulnerability exists in the affected products, which may allow a remote attacker who successfully obtained the user credentials by analyzing the affected product to access the controller. This issue is related to the communication functions between the machine automation controller, automation software, and programmable terminal.

Recommendations For Machine automation controller NJ series versions 1.48 and earlier, update to a version later than 1.48 to resolve the issue. For Machine automation controller NX7 series versions 1.28 and earlier, update to a version later than 1.28 to resolve the issue. For Machine automation controller NX1 series versions 1.48 and earlier, update to a version later than 1.48 to resolve the issue. For Automation software 'Sysmac Studio' versions 1.49 and earlier, update to a version later than 1.49 to resolve the issue. For Programmable Terminal (PT) NA series NA5-15W/NA5-12W/NA5-9W/NA5-7W models Runtime versions 1.15 and earlier, update to a version later than 1.15 to resolve the issue. As a temporary workaround, consider restricting access to the affected products until a patch is available.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

BDU:2022-04255

CVE-2022-34151

Affected Products

Na Series

Nj Series

Nx1 Series

Nx7 Series

Sysmac Studio

References · 9

• https://bdu.fstec.ru/vul/2022-04255 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-34151 · Security Note
• https://ia.omron.com/product/vulnerability/OMSR-2022-001_en.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-34151 · Vendor Advisory
• https://jvn.jp/en/vu/JVNVU97050784/index.html · Note
• https://attack.mitre.org/software/S1045 · Note
• https://twitter.com/ravirockks/status/1705031952615796778 · Twitter Post
• https://vuldb.com/?id.203183 · Note
• https://t.me/cibsecurity/45555 · Telegram Post